SQL Server campaign installs Gh0st RAT and a Monero miner via T-SQL
Original title: Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
FortiGuard says the October campaign brute-forces port 1433, enables xp_cmdshell, and plants Edge-themed scheduled tasks.
FortiGuard Labs describes an early October 2026 campaign against Internet-facing Microsoft SQL Server hosts. A UPX-packed Go scanner using Naabu probes port 1433, then a .NET tool brute-forces accounts from wordlists. After login, T-SQL enables xp_cmdshell and a downloader installs a Monero miner and a Gh0st RAT variant. The RAT command servers were offline during analysis.
Unconfirmed: A Chinese-language lineage is inferred from features; the RAT servers were already offline, so behavior was reviewed statically.
- The scanner requests /16 ranges and sends TCP SYN probes to port 1433.
- pass.txt holds more than 2,700 passwords, and the tool uses up to 500 threads.
- Persistence includes Edge-themed scheduled tasks and Secs.exe copied to Startup.
- The miner contacts xmr-ru.kryptex.network and uses the user agent XMRig Reporter.
- The RAT supports more than 30 commands, including keylogging and QQ data theft.
Impact: OS command execution, remote control, and CPU cryptomining
| Product | Affected |
|---|---|
| Microsoft SQL Server | — |
- 1.Do not expose SQL Server port 1433 to the Internet.
- 2.Disable or rename sa, require long unique passwords with lockout, and keep xp_cmdshell disabled.
- 3.Hunt Edge-update tasks pointing at C:\Users\Public or E:, plus Secs.exe, Google.exe, payload.exe, and vietnam852[.]com.
- ATT&CK
- T1110 Brute ForceT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1105 Ingress Tool TransferT1547.001 Registry Run Keys / Startup Folder
- Vendors
- Microsoft
- Products
- Microsoft SQL Server
- Organizations
- FortiGuard Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | swordaa.com | ardcoded C2 endpoints: server.vietnam852[.]com:8000 and www.swordaa[.]com:8000. The RAT supports more than 30 control commands. The |
| domain | vietnam852.com | 2 port scanner. It requests a target range from hxxp://site.vietnam852[.]com:88/ip.php and converts the returned address into a hardco |
| domain | xmr-ru.kryptex.network | onero miner that uses the victim’s CPU. Its traffic goes to xmr-ru.kryptex.network, and it reports mining status to the attacker through an HT |
| url | http://site.vietnam852.com:88/2026/2018.sql | vietnam852[.]com 88 Domain server.vietnam852[.]com 8000 URL hxxp://site.vietnam852[.]com:88/2026/2018.sql 88 URL hxxp://site.vietnam852[.]com:88/2026/dwm.exe 88 UR |
| url | http://site.vietnam852.com:88/2026/dwm.exe | 00 URL hxxp://site.vietnam852[.]com:88/2026/2018.sql 88 URL hxxp://site.vietnam852[.]com:88/2026/dwm.exe 88 URL hxxp://site.vietnam852[.]com:88/2026/go.bat 88 Not |
| url | http://site.vietnam852.com:88/2026/go.bat | 88 URL hxxp://site.vietnam852[.]com:88/2026/dwm.exe 88 URL hxxp://site.vietnam852[.]com:88/2026/go.bat 88 Note: IP addresses and domains are intentionally defan |
| url | http://site.vietnam852.com:88/ip.php | urce Naabu v2 port scanner. It requests a target range from hxxp://site.vietnam852[.]com:88/ip.php and converts the returned address into a hardcoded /16 CI |
From the original article
3 min read at gbhackers.com
An active campaign in early October 2026 that targets Internet-facing Microsoft SQL Server instances. The entry point is dllhost. exe, a Go binary packed with UPX that embeds the open-source Naabu v2 port scanner.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.