FortiGuard Labs identified a hacking campaign targeting internet-facing Microsoft SQL Server databases. The operation, active since early October 2026, relies on brute-forcing weak passwords rather than exploiting software vulnerabilities.
Attackers utilize the Naabu scanner to locate reachable SQL Server instances. A .NET-based tool then tests over 2,700 common passwords to gain unauthorized access to the systems.
Once inside, the attackers enable the xp_cmdshell feature to execute administrative commands on the host operating system. This allows for the deployment of two primary malicious payloads.
The first payload is an XMRig-based Monero miner disguised as MicrosoftEdgeUpdate.exe. It connects to mining pools such as nanopool and kryptex, consuming CPU resources on the compromised servers.
The second payload is a variant of the Gh0st RAT, which provides remote access and supports over 30 commands, including keylogging, screen capture, and credential theft from the QQ messaging platform.
The malware establishes persistence through registry modifications and scheduled tasks. Security researchers noted Chinese-language indicators within the code, though no specific victim count is confirmed.
