Cybercriminals are targeting exposed Microsoft SQL Server systems by employing an extensive list of over 2,700 passwords. Once access is obtained, they install malicious software, including a cryptocurrency miner and a remote access trojan (RAT), compromising the server’s security and performance.
Ongoing Attack Campaign on SQL Servers
This campaign, active since early October 2026, specifically targets database servers due to their valuable data. Attackers scan for publicly accessible servers, utilize various login attempts, and execute commands that deploy additional malware. The strategy mirrors previous attacks on MS-SQL servers, showcasing a persistent threat landscape.
Fortinet’s FortiGuard Labs has scrutinized the campaign, with researcher Xiaopeng Zhang highlighting the exploitation of T-SQL commands to manipulate compromised servers. The severity of this threat is rated high by FortiGuard, emphasizing the need for robust security measures.
Technical Breakdown of the Malware Deployment
The attack sequence initiates with a file named dllhost.exe, camouflaged to resemble a legitimate Windows process. Embedded within is the Naabu port scanner, which contacts the attacker’s server to receive an IP range for scanning open TCP port 1433, the default for SQL Server.
Successful intrusion results in downloading multiple support files, including scripts and a brute-force tool. The malware attempts to crack logins using common usernames and a vast array of passwords, leveraging up to 500 threads concurrently. This attack vector exploits weak or reused passwords, a recurring vulnerability in server security.
Consequences and Recommendations
Upon gaining access, the attackers execute a file that enables xp_cmdshell, allowing them to run Windows commands on the server. This facilitates the download of additional programs disguised as legitimate files, further embedding the malware within the system.
The consequences include deploying a Monero cryptocurrency miner and the Gh0st RAT, which can exfiltrate data, log keystrokes, and provide remote control capabilities. The resulting drain on server resources leads to degraded performance and increased operational costs.
To mitigate these risks, it is crucial to restrict SQL Server access, implement strong and unique passwords, and disable unnecessary features like xp_cmdshell. Regular monitoring for unusual tasks and resource usage can also help detect and prevent intrusions.
Overall, this campaign underscores the importance of cybersecurity vigilance and proactive defense strategies to protect critical infrastructure from increasingly sophisticated threats.
