SEO: Fortinet discovered a campaign where attackers brute-force exposed Microsoft SQL Server installations and abuse T-SQL commands to deploy a Monero miner and Gh0st RAT on Windows systems.
A weak Microsoft SQL Server password can offer attackers more than access to a database- it can also allow them to run programs on the Windows machine hosting it. Fortinet’s FortiGuard Labs has released details of a campaign that takes advantage of this.
In its research published on 12 November, FortiGuard Labs explained that using brute-force attacks the attacker are trying to install a Monero miner and a Gh0st Remote Access Trojan (RAT) on compromised servers.
This particular campaign was discovered in early October 2026. Researchers found that it specifically targets internet-exposed SQL Server installations and doesn’t rely on a newly discovered software vulnerability.
Fortinet found that its Go-based payload dllhost.exe scans for these servers with the open-source Naabu tool, checking TCP port 1433 (which SQL Server uses by default). The malware gets IP addresses from its server, expands them into /16 network ranges and scans addresses across those ranges. When it finds an open port, another program attempts to log in using usernames such as sa and admin and over 2,700 preset passwords.
An open port does not mean the attackers have access to the database. For that, the malware launches another program, dwm.exe, which tries usernames such as sa and admin against a password list containing more than 2,700 entries.
How a SQL Server Becomes a Way Into Windows
After gaining access to a SQL Server the attackers run commands from a file named 2018.sql using Transact-SQL (T-SQL)- Microsoft’s version of SQL used by SQL Server. One of the commands enables xp_cmdshell. It is a feature that lets SQL Server run Windows commands. This step allows the attackers to use the database connection to download and run programs on the computer hosting the server.
The script places malicious executables in the Windows Public folder. One of them (Secs.exe) acts as a downloader, which, Fortinet explains, connects to an FTP server controlled by the attackers. It also downloads more executable files and runs them on the infected machine. And, it creates scheduled tasks to keep the malware running and shares details about the computer with the attackers, which may include its public IP address, country, Windows version, processor and RAM.
A Miner and a Remote Access Trojan
Two of the downloaded files reveal what the attackers want from these machines. MicrosoftEdgeUpdate.exe is not a browser update, despite its name. It is a Monero miner that uses the server’s CPU to mine cryptocurrency for a wallet address embedded in the malware.
The other file titled winlogon.exe is a Gh0st RAT variant. Its capabilities include keylogging, screen capture, file management and remote shell access. Fortinet identified more than 30 control commands, while additional functions, including remote desktop, are handled through plugins.
The RAT can also survive a system restart. It adds a registry entry, installs itself as a Windows service and creates a scheduled task that launches it every 30 minutes. Fortinet could not fully examine the RAT’s live communications because its command-and-control server was already offline when the researchers analysed the sample.
Attack chain explained (Source: Fortinet)
Experts’ comments
Shane Barney, Chief Information Security Officer at Keeper Security, shared with Hackread.com that the campaign highlights the risks of leaving privileged credentials exposed across complex and legacy IT environments.
“This campaign illustrates the persistent challenge IT and security teams face: securing privileged access across complex, and often legacy, infrastructure. While internet-facing databases are sometimes the unintended result of technical debt or misconfigurations, relying on static, standing credentials is what turns that exposure into a critical vulnerability. When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit.
“The root of this challenge often lies in secrets management. Database credentials frequently remain static because they are hardcoded into legacy applications, embedded in automated scripts, or shared among administrators to maintain uptime. However, attackers know this and routinely scan default ports because these standing privileges yield massive operational leverage. Once inside, dropping cryptominers is often just a smokescreen for establishing long-term persistence through remote access tools.
“Beyond initial network segmentation, closing this attack path requires an identity-first approach through modern privileged access management (PAM). Rather than leaving database administrator credentials exposed, security teams should transition toward zero standing privilege with automated credential rotation and ephemeral, time-limited access. In a mature, zero-trust environment, administrators shouldn’t even need to know the actual database password. Pairing zero-trust access controls with continuous session monitoring ensures administrators execute necessary queries through a secure, brokered connection without exposing the underlying administrative credentials.”
Jason Soroko, Senior Fellow at Sectigo, also shared his comments, pointing to the danger of treating the cryptocurrency miner as the main problem when a remote access tool has also been installed.
“This campaign turns a database login into a way to run malware on the server. Attackers guess weak passwords, then use SQL Server’s administrative features to launch Windows commands. That makes the privileges of both the database account and the account running SQL Server central to the risk. The miner consumes resources, while the remote access trojan can steal information and maintain access. Removing the miner alone would leave the wider compromise unresolved.
“Organizations should remove direct internet access to SQL Server, restrict connections to approved systems, and enforce strong, unique credentials. Administrative access should be limited to accounts that need it. Keep xp_cmdshell, the feature used to launch Windows commands, disabled unless required, and monitor attempts to enable it. Security teams should investigate SQL Server spawning command shells, new scheduled tasks and failed logins followed by success. A compromised server needs containment, a search for persistence and a review of exposed credentials before it returns to service.”
Click Here For The Original Source.
——————————————————–
