Attackers brute-force exposed SQL Server, then drop miner and Gh0st RAT

Original title: Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware

Cyber Security Newsby Tushar Subhra DuttaNov 13, 2026 · 14:54 UTC (23h ago)4 min read1

Part of a story covered by 4 sourcesWeak SQL Server passwords used to install miner and Gh0st RATMerged summary & timeline

AI summary · x-ai/grok-4.7Summaries by Vani AI

Fortinet says the campaign, seen since early October 2026, scans port 1433 and tries more than 2,700 passwords.

FortiGuard Labs described a campaign that scans for internet-facing Microsoft SQL Server on TCP port 1433, guesses logins with more than 2,700 passwords, and then installs a Monero miner and a Gh0st RAT variant. A Go binary packed with UPX, named dllhost.exe, uses Naabu to scan IP ranges. After a successful login, T-SQL in 2018.sql enables xp_cmdshell, downloads payloads and creates persistence that imitates Microsoft Edge updates. The miner connects to pools such as nanopool and kryptex. The RAT can log keystrokes, manage files, open a shell, wipe event logs and steal QQ data. Command servers were offline during Fortinet’s test.

Unconfirmed: Gh0st RAT command servers were offline during Fortinet’s analysis, so live behavior was not fully observed.

Key facts

Fortinet published the report on November 12, 2026, and rates severity high.
The brute-force tool tries names such as sa and admin with up to 500 threads.
Persistence includes a daily task named Microsoft_UPDATES and a task every 30 minutes.
The RAT checks for 78 security-product process names and supports more than 30 commands.
Fortinet published domains, URLs and SHA-256 hashes for the campaign files.

Security assessment · AI, from the article

Impact: Remote control of servers plus cryptocurrency mining on their CPUs

Product	Affected
Microsoft SQL Server	internet-facing systems with weak logins

What to do

1.Keep SQL Server off the internet and block TCP 1433 from outside networks.
2.Use long unique passwords, restrict the sa account, and disable xp_cmdshell if unused.
3.Watch for fake Edge-update tasks, files in C:\Users\Public, and CPU spikes.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1110.001 Password Guessing T1059 Command and Scripting Interpreter T1053.005 Scheduled Task T1496 Resource Hijacking

Tags: sql-server brute-force gh0st-rat cryptominer monero

Vendors: Microsoft
Products: Microsoft SQL Server
Malware: Gh0st RAT Naabu
Organizations: Fortinet

Indicators of compromise

auto-extracted · verify before use · export allAll

Type	Indicator	Context
domain	hfgjjkrewjk.com	T C2 Domain www.swordaa[.]com:8000 Gh0st RAT C2 Domain site.hfgjjkrewjk[.]com Mining status reporting Domain site.jiancai008[.]com Payl
domain	jiancai008.com	site.hfgjjkrewjk[.]com Mining status reporting Domain site.jiancai008[.]com Payload hosting URL hxxp://site.vietnam852[.]com:88/ip.ph
domain	swordaa.com	Domain server.vietnam852[.]com:8000 Gh0st RAT C2 Domain www.swordaa[.]com:8000 Gh0st RAT C2 Domain site.hfgjjkrewjk[.]com Mining st
domain	vietnam852.com	compromise (IoCs):- Type Indicator Description Domain site.vietnam852[.]com:88 Campaign file server Domain ftp.vietnam852[.]com:88 FT
sha256	124774698fd3ede0800015d19c2bd6c1869d03bbc2e6e8dbe2f69d2978f7f4d0	88AD2E86B7646A163AA453B1703905A4B359070F sqlcmd.exe SHA-256 124774698FD3EDE0800015D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0 dwm.exe SHA-256 125D3A0EFE7699BB20397C13F0F4993AD8939527274
sha256	125d3a0efe7699bb20397c13f0f4993ad893952727487b4d190e386a5b14c427	5D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0 dwm.exe SHA-256 125D3A0EFE7699BB20397C13F0F4993AD893952727487B4D190E386A5B14C427 down.exe / Google.exe / payload.exe SHA-256 20983573B840447
sha256	20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0	90E386A5B14C427 down.exe / Google.exe / payload.exe SHA-256 20983573B840447E1AACD6D3F6DD240732B15037D268D6456F0D3C4EC5051CB0 down.exe / Google.exe / payload.exe SHA-256 58DB0CA2054ABE2
sha256	2a0d2889241885d5ea6fe7dd1b1adc83653a0c07b8aaa1b0832e5f9c0225b379	363B7441AC0B8ECFE96A77FD94B9C312A017588EB4 2018.sql SHA-256 2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379 go.bat SHA-256 79596CF6E267EF5CB658BD97D04E42A41001D36595E3
sha256	2a23e10bfc097e98295cbff8124bd403c4cb677e709b48ccc53d6aca216c3061	825C848FCD56C7E8F05 Embedded downloader in 2018.sql SHA-256 2A23E10BFC097E98295CBFF8124BD403C4CB677E709B48CCC53D6ACA216C3061 MicrosoftEdgeUpdate.exe (XMR miner) SHA-256 DA4128AA5D006E0
sha256	3f64b0146b323c5716043360e84384a5a197a897f46088df93a910470a29e1a0	30059C7A3498724 MicrosoftEdgeUpdate.exe (XMR miner) SHA-256 3F64B0146B323C5716043360E84384A5A197A897F46088DF93A910470A29E1A0 winlogon.exe (Gh0st RAT) Note: IP addresses and domains are
sha256	58db0ca2054abe2989412d7a1c8ed16718577f893c196825c848fcd56c7e8f05	F0D3C4EC5051CB0 down.exe / Google.exe / payload.exe SHA-256 58DB0CA2054ABE2989412D7A1C8ED16718577F893C196825C848FCD56C7E8F05 Embedded downloader in 2018.sql SHA-256 2A23E10BFC097E98295
sha256	79596cf6e267ef5cb658bd97d04e42a41001d36595e370441adb3c2b5dd5666c	E7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379 go.bat SHA-256 79596CF6E267EF5CB658BD97D04E42A41001D36595E370441ADB3C2B5DD5666C go.vbs SHA-256 D6E3FD28F479138B336E2C2088AD2E86B7646A163AA4
sha256	8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d	e.vietnam852[.]com/tj/xmr.php?data= Miner reporting SHA-256 8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D dllhost.exe SHA-256 F5444E8E9E9E019693AACB363B7441AC0B8ECFE
sha256	d6e3fd28f479138b336e2c2088ad2e86b7646a163aa453b1703905a4b359070f	BD97D04E42A41001D36595E370441ADB3C2B5DD5666C go.vbs SHA-256 D6E3FD28F479138B336E2C2088AD2E86B7646A163AA453B1703905A4B359070F sqlcmd.exe SHA-256 124774698FD3EDE0800015D19C2BD6C1869D03BB
sha256	da4128aa5d006e05c58f0d240c2d8e5fb02774b6acf314f1230059c7a3498724	53D6ACA216C3061 MicrosoftEdgeUpdate.exe (XMR miner) SHA-256 DA4128AA5D006E05C58F0D240C2D8E5FB02774B6ACF314F1230059C7A3498724 MicrosoftEdgeUpdate.exe (XMR miner) SHA-256 3F64B0146B323C5
sha256	f5444e8e9e9e019693aacb363b7441ac0b8ecfe96a77fd94b9c312a017588eb4	4AEA042C41807F632CD691D5091705BF6C0076D dllhost.exe SHA-256 F5444E8E9E9E019693AACB363B7441AC0B8ECFE96A77FD94B9C312A017588EB4 2018.sql SHA-256 2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8
url	http://ftp.vietnam852.com:88/post.php	URL hxxp://site.vietnam852[.]com:88/down.exe Downloader URL hxxp://ftp.vietnam852[.]com:88/post.php Host registration URL hxxp://site.jiancai008[.]com:88/tes
url	http://ftp.vietnam852.com:88/test/MicrosoftEdgeUpdate.exe	://site.jiancai008[.]com:88/test/winlogon.exe Gh0st RAT URL hxxp://ftp.vietnam852[.]com:88/test/MicrosoftEdgeUpdate.exe XMR miner URL hxxp://site.vietnam852[.]com/tj/xmr.php?dat
url	http://site.jiancai008.com:88/test/winlogon.exe	xp://ftp.vietnam852[.]com:88/post.php Host registration URL hxxp://site.jiancai008[.]com:88/test/winlogon.exe Gh0st RAT URL hxxp://ftp.vietnam852[.]com:88/test/Microso
url	http://site.vietnam852.com:88/2026/2018.sql	hxxp://site.vietnam852[.]com:88/ip.php Target IP range URL hxxp://site.vietnam852[.]com:88/2026/2018.sql Malicious T-SQL URL hxxp://site.vietnam852[.]com:88/2026/
url	http://site.vietnam852.com:88/2026/dwm.exe	/site.vietnam852[.]com:88/2026/2018.sql Malicious T-SQL URL hxxp://site.vietnam852[.]com:88/2026/dwm.exe Brute-force tool URL hxxp://site.vietnam852[.]com:88/down
url	http://site.vietnam852.com:88/down.exe	/site.vietnam852[.]com:88/2026/dwm.exe Brute-force tool URL hxxp://site.vietnam852[.]com:88/down.exe Downloader URL hxxp://ftp.vietnam852[.]com:88/post.php Ho
url	http://site.vietnam852.com:88/ip.php	reporting Domain site.jiancai008[.]com Payload hosting URL hxxp://site.vietnam852[.]com:88/ip.php Target IP range URL hxxp://site.vietnam852[.]com:88/2026/
url	http://site.vietnam852.com/tj/xmr.php?data=	tnam852[.]com:88/test/MicrosoftEdgeUpdate.exe XMR miner URL hxxp://site.vietnam852[.]com/tj/xmr.php?data= Miner reporting SHA-256 8CE2CD98EF6CEEECE8239936E4AEA042C

From the original article

4 min read at cybersecuritynews.com

A new campaign is guessing its way into internet-facing Microsoft SQL Server systems. The attackers use a list of more than 2,700 passwords and then install a cryptocurrency miner and a remote access trojan (RAT) on the hacked machines. The campaign has been running since at least early October 2026.

Cyber Security News

By Tushar Subhra Dutta · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.