Active Campaign Hijacks Internet-Facing Microsoft SQL Servers via T-SQL to Deploy Gh0st RAT and Monero Miners
In early October 2026, an active threat campaign targeted Internet-facing Microsoft SQL Server instances by exploiting exposed port 1433. The attackers used a UPX-packed Go binary masquerading as dllhost.exe to scan /16 CIDR blocks for SQL servers using embedded Naabu v2. They performed brute-force credential attacks using a large password list against accounts like sa and admin. Upon successful authentication, native T-SQL commands enabled xp_cmdshell to execute OS commands and deploy payloads including a Monero miner and a Gh0st RAT variant. Persistence was maintained via scheduled tasks mimicking Microsoft Edge Update entries, registry run keys, and startup folder executables. The Gh0st RAT supports extensive espionage and control features and communicates with hardcoded C2 servers. Defenders are urged to block port 1433 externally, disable or rename the sa account, enforce strong password policies, disable xp_cmdshell, and hunt for indicators such as malicious scheduled tasks and connections to vietnam852[.]com.
Linha do tempo
-
Active Campaign Hijacks Internet-Facing Microsoft SQL Servers via T-SQL to Deploy Gh0st RAT and Monero Miners
ler a análise desta fonte ocultar
In early October 2026, an active threat campaign targeted Internet-facing Microsoft SQL Server instances by exploiting exposed port 1433. The attackers used a UPX-packed Go binary masquerading as dllhost.exe to scan /16 CIDR blocks for SQL servers using embedded Naabu v2. They performed brute-force credential attacks using a large password list against accounts like sa and admin. Upon successful authentication, native T-SQL commands enabled xp_cmdshell to execute OS commands and deploy payloads including a Monero miner and a Gh0st RAT variant. Persistence was maintained via scheduled tasks mimicking Microsoft Edge Update entries, registry run keys, and startup folder executables. The Gh0st RAT supports extensive espionage and control features and communicates with hardcoded C2 servers. Defenders are urged to block port 1433 externally, disable or rename the sa account, enforce strong password policies, disable xp_cmdshell, and hunt for indicators such as malicious scheduled tasks and connections to vietnam852[.]com.