Hackers Abuse Weak SQL Server Passwords to Deploy Cryptominers, Gh0st RAT

An active threat campaign is compromising exposed Microsoft SQL Servers by combining port scanning, brute-force password guessing, and Transact-SQL (T-SQL) commands to deliver malware payloads.

The attackers exploit weak administrative credentials to gain control, subsequently executing commands on the underlying Windows operating systems. This activity highlights the ongoing challenge of securing privileged access in complex and often legacy infrastructure.

FortiGuard researcher Xiaopeng Zhang detailed the campaign, observing two primary payloads: an XMRig-based Monero cryptocurrency miner and a variant of the Gh0st remote access trojan (RAT).

Brute-Force Attacks Lead to System Takeover

The attack chain begins with a Go-based executable, identified as "dllhost.exe," which initiates an open-source port scanner named Naabu. This scanner retrieves target IP ranges from an attacker-controlled server and identifies systems with TCP port 1433 open, the default port for Microsoft SQL Server.

Once reachable servers are identified, a separate executable, "dwn.exe," launches a brute-force attack. It attempts to authenticate using common usernames like "sa" and "admin" against a predefined list of over 2,700 passwords.

Successful logins grant attackers more than just database access. The malware executes a series of malicious T-SQL commands from a file named "2018.sql," leveraging SQL Server’s administrative functionality to run commands on the compromised Windows machine. Crucially, these commands enable xp_cmdshell, a SQL Server feature that allows database administrators to execute Windows command shell operations.

Attackers then use xp_cmdshell to download or extract further executables into the server’s "C:\Users\Public" directory and run them.

Shane Barney, chief information security officer at Keeper Security, noted that relying on static, standing credentials turns exposed databases into critical vulnerabilities. "When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit," he said.

Cryptominers and Gh0st RAT Delivered

The malicious T-SQL commands deploy a loader to retrieve additional executables from the attackers’ FTP infrastructure. Among these is a Monero cryptocurrency miner, observed as "MicrosoftEdgeUpdate.exe," which masquerades as a legitimate browser update.

This XMRig-based miner hijacks the compromised server’s CPU resources to mine Monero, communicating with mining pools using an embedded wallet address.

A variant of the Gh0st RAT, delivered via "Winlogon.exe," provides extensive remote access capabilities. FortiGuard researchers identified functionalities including keylogging, file management, data theft, remote shell execution, and process management, with over 30 control commands. The RAT also supports screen capture and remote desktop access through plugins.

The attackers employ multiple persistence mechanisms. The initial payload creates a scheduled task that runs every 30 minutes, while the downloader establishes another task for daily execution at 1 AM. The Gh0st RAT, meanwhile, adds itself to the Windows registry’s Run key, installs a Windows service, and creates a scheduled task to launch itself every 30 minutes.

Microsoft did not immediately respond to a request for comment regarding the active campaign.

Mitigation and Recommendations

Jason Soroko, senior fellow at Sectigo, advised organisations to remove direct internet access to SQL Server, restrict connections to approved systems, and enforce strong, unique credentials. "Administrative access should be limited to accounts that need it," he added.

Soroko also recommended keeping xp_cmdshell disabled unless strictly necessary and monitoring any attempts to enable it.

Keeper Security’s Barney cautioned that cryptominers can serve as a distraction. Attackers may use mining activity as "a smokescreen for establishing long-term persistence through remote access tools," allowing them to maintain access for more serious objectives like data exfiltration or further network penetration.

FortiGuard provides detection coverage for this campaign through its FortiGuard IPS, Web Filtering, and Antivirus services. The company has also shared indicators of compromise (IoCs) to assist non-customers in detecting potential infections.