Weak SQL Server passwords used to plant miner and Gh0st RAT
Original title: Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT
FortiGuard Labs found a campaign scanning port 1433, brute-forcing logins, then installing XMRig and a Gh0st RAT variant.
FortiGuard Labs uncovered a campaign, first seen in early October 2026, that breaks into internet-facing Microsoft SQL Server instances with weak passwords. A Go payload uses Naabu to scan TCP 1433, then a brute-force tool tries names such as sa and admin against more than 2700 passwords. After login, T-SQL enables xp_cmdshell, downloads a loader, and sets daily and Startup persistence. The loader fetches a Monero miner based on XMRig and a Gh0st RAT variant that supports keylogging, data theft and remote control. The report does not name victims or operators.
Unconfirmed: The number of compromised servers and the operators were not identified.
- Fortinet rated the campaign high severity in research published November 12.
- The miner is named like a Microsoft Edge update and reports when mining starts.
- The RAT's C2 was already shut down, so researchers analyzed it without running it.
- Host details sent back include public IP, Windows edition, user name and host name.
- Persistence includes a Run key, a service and a task every 30 minutes.
Impact: Remote control, data theft and cryptomining on compromised SQL servers
| Product | Affected |
|---|---|
| Microsoft SQL Server | — |
- 1.Disable or restrict xp_cmdshell on internet-facing SQL Server instances.
- 2.Replace weak sa and admin passwords and limit exposure of TCP 1433.
- ATT&CK
- T1110.001 Password GuessingT1046 Network Service DiscoveryT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1496 Resource Hijacking
- Vendors
- Microsoft
- Products
- SQL Server
- Organizations
- FortiGuard LabsFortinet
From the original article
2 min read at infosecurity-magazine.com
Fortinet finds weak SQL Server passwords used to deliver a miner and Gh0st RAT
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.