Roundup: Baker Tilly breach, Railway key theft, OpenAI agent incident
The digest also covers an ex-FBI crypto theft plea, exposed SQL servers, and a fixed Codex workflow flaw.
58
- Mentions · 7d4
- Mentions · 30d4
- All mentions4
- First seenNov 12, 2026
- Last mentioned23h ago
Timeline
4 articles · newest firstAttackers brute-force exposed SQL Server, then drop miner and Gh0st RAT
Fortinet says the campaign, seen since early October 2026, scans port 1433 and tries more than 2,700 passwords.
68
SQL Server campaign installs Gh0st RAT and a Monero miner via T-SQL
FortiGuard says the October campaign brute-forces port 1433, enables xp_cmdshell, and plants Edge-themed scheduled tasks.
74
Attackers brute-force exposed SQL Servers to deploy XMRig and Gh0st RAT
A Go scanner finds TCP 1433, guesses sa and admin logins, then enables xp_cmdshell to run Windows commands.
66
Appears with
- Gh0st RATmalware · 4
- Microsoftvendor · 4
- Microsoft SQL Serverproduct · 3
- Fortinetorganization · 2
- SQL Serverproduct · 1
- Codexproduct · 1
- FortiGuard Labsorganization · 1
- FBIorganization · 1
- Baker Tillyvictim · 1
- Siemensvendor · 1
- FortiGuardorganization · 1
- OpenAIvendor · 1
- XMRigmalware · 1
- CISAorganization · 1
- Railwayvictim · 1
- Nemotron-Terminal-8Bai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.