Attackers brute-force exposed SQL Servers to deploy XMRig and Gh0st RAT
Original title: Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT
A Go scanner finds TCP 1433, guesses sa and admin logins, then enables xp_cmdshell to run Windows commands.
FortiGuard described an active campaign that scans for Microsoft SQL Server on TCP port 1433, brute-forces logins such as sa and admin with a password list of more than 2700 entries, and runs T-SQL from 2018.sql. Successful logins enable xp_cmdshell and drop files into C:\Users\Public. Payloads include an XMRig-based Monero miner posing as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant delivered as Winlogon.exe, with scheduled tasks, a Run key and a Windows service for persistence. Microsoft had not commented. FortiGuard published indicators for non-customers.
Unconfirmed: Microsoft had not responded, and FortiGuard did not name victim organizations.
- The initial payload dllhost.exe uses the Naabu scanner against attacker-supplied IP ranges.
- dwn.exe tries usernames including sa and admin against more than 2700 passwords.
- The miner uses an embedded Monero wallet; Gh0st RAT exposes more than 30 control commands.
- Persistence includes tasks every 30 minutes, a daily 1 AM task, a Run key and a service.
Impact: Remote control, keylogging, data theft and Monero mining
| Product | Affected |
|---|---|
| Microsoft SQL Server | — |
- 1.Remove direct internet access to SQL Server and limit logins to approved systems.
- 2.Use strong unique credentials and restrict administrative accounts.
- 3.Keep xp_cmdshell disabled unless required and monitor attempts to enable it.
- ATT&CK
- T1046 Network Service DiscoveryT1110 Brute ForceT1059.001 PowerShellT1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup Folder
- Vendors
- Microsoft
- Products
- SQL Server
- Organizations
- FortiGuard
From the original article
3 min read at csoonline.com
An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.