Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Weak SQL Server passwords used to install miner and Gh0st RAT

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

FortiGuard reports an active campaign brute-forcing internet-facing SQL Server logins to install XMRig and Gh0st RAT.

FortiGuard Labs described an active campaign, first seen in early October 2026 and rated high severity, that scans for Microsoft SQL Server on TCP 1433. A Go tool uses Naabu against attacker-supplied ranges, then a brute-force utility tries names such as sa and admin against more than 2700 passwords. Successful logins run T-SQL from 2018.sql, enable xp_cmdshell, and drop files into C:\Users\Public. Payloads are an XMRig-based Monero miner posing as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant delivered as Winlogon.exe, with scheduled tasks, a Run key and a Windows service for persistence. According to FortiGuard, the RAT command server was already shut down; Microsoft had not commented, and no victims or operators were named.

Key facts
  • Campaign first seen in early October 2026; Fortinet rated it high severity.
  • Scanner targets TCP 1433; logins include sa and admin against 2700-plus passwords.
  • xp_cmdshell drops an XMRig miner and a Gh0st RAT with more than 30 commands.
  • Persistence uses 30-minute and daily tasks, a Run key and a Windows service.
  • FortiGuard published indicators; the RAT command server was already shut down.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 12, 2026FortiGuard published research on the SQL campaign · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • CSO OnlineNames dllhost.exe, dwn.exe, 2018.sql, Public-folder drops and Microsoft silence.
  • Infosecurity MagazineDates first sighting to early October and says the RAT C2 was shut down.
Vendors
Microsoft
Products
SQL Server
Malware
XMRigGh0st RATNaabu
Organizations
FortiGuardFortiGuard LabsFortinet

Coverage

oldest first · one row per article · UTC
  1. · 11h ago CSO OnlineFirst report

    Attackers brute-force exposed SQL Servers to deploy XMRig and Gh0st RAT

    A Go scanner finds TCP 1433, guesses sa and admin logins, then enables xp_cmdshell to run Windows commands.

  2. · 9h ago Infosecurity Magazine

    Weak SQL Server passwords used to plant miner and Gh0st RAT

    FortiGuard Labs found a campaign scanning port 1433, brute-forcing logins, then installing XMRig and a Gh0st RAT variant.