Threat Actors Crack Microsoft SQL Servers Using 2,700 Passwords, Then Deploy Remote Access Malware

A newly uncovered cyberattack campaign is systematically compromising internet-exposed Microsoft SQL Server environments by leveraging an extensive password-cracking operation. The threat actors rely on a dictionary of more than 2,700 commonly used and weak passwords to gain unauthorized access, after which they deploy a cryptocurrency mining payload alongside a powerful remote access trojan (RAT), enabling long-term control of compromised systems.

The operation has been active since at least October 2026 and highlights the continuing risks associated with publicly accessible database infrastructure. Because Microsoft SQL Server instances often store sensitive corporate information, customer records, financial data, and business-critical applications, they remain high-value targets for attackers seeking financial gain and persistent network access.

The campaign follows a familiar but highly effective strategy. Attackers continuously scan the internet for exposed SQL Server systems, attempt thousands of login combinations, and then execute malicious commands that download and install additional malware. Similar tactics have been observed repeatedly in previous attacks targeting MSSQL servers, including malware distribution and ransomware deployment campaigns reported earlier this year.

Researchers from Fortinet’s FortiGuard Labs detailed the entire attack chain in a report released on November 12, 2026. According to security researcher Xiaopeng Zhang, the attackers abuse Transact-SQL (T-SQL), Microsoft’s proprietary extension to SQL, to execute operating system commands directly from compromised database servers. Fortinet classified the threat as a high-severity campaign due to its combination of credential attacks, persistence mechanisms, and remote-control capabilities.

Password-Spraying Operation Targets Internet-Facing SQL Servers

The infection process begins with a malicious executable named dllhost.exe, a Go-based malware component packed with the UPX executable compressor to conceal its functionality and hinder analysis. By adopting the name of a legitimate Windows process, the malware attempts to avoid suspicion and blend into normal system activity.

Embedded within the malware is Naabu, a legitimate open-source network scanning tool that has been repurposed for malicious activity. After execution, the malware contacts a command-and-control (C2) server operated by the attackers and receives a range of IP addresses to scan.

Using Naabu, it probes random internet addresses for TCP port 1433, the default communication port used by Microsoft SQL Server. Any system found listening on that port is recorded and saved to a file named Result.txt, after which the malware continues requesting additional IP ranges to scan.

The malware then downloads several supporting components, including scripts such as go.vbs and go.bat, along with a credential-brute-forcing utility disguised as dwm.exe.

Despite its misleading filename, dwm.exe is a .NET-based password-cracking tool specifically designed to target SQL Server login credentials. The program reads potential usernames, including commonly targeted accounts such as sa and admin, and systematically attempts authentication using a password list containing more than 2,700 entries. To maximize efficiency, the tool can launch up to 500 simultaneous threads, dramatically accelerating brute-force attempts against vulnerable systems.

The campaign succeeds primarily because organizations continue to rely on weak, predictable, or reused passwords. The same security weakness has been exploited in numerous previous incidents where threat actors brute-forced MSSQL credentials before deploying ransomware, cryptominers, or backdoor malware.

Attackers Abuse SQL Server Features to Execute Malicious Code

Once valid credentials are discovered, the attackers immediately leverage their access to execute a malicious SQL script named 2018.sql.

The script enables xp_cmdshell, a powerful SQL Server feature that allows Windows commands to be executed directly from the database engine. Although xp_cmdshell can be useful for administrative automation, it is frequently abused by attackers because it provides a straightforward pathway from database access to full operating system compromise.

After activating xp_cmdshell, the attackers download additional malware into the C:\Users\Public directory, storing payloads under filenames such as Google.exe or payload.exe.

Persistence is established through multiple mechanisms. A scheduled task named Microsoft_UPDATES is created to launch malware daily, while another component, Secs.exe, is placed inside the Windows Startup folder to ensure execution after user logins.

Additional scheduled tasks are configured to execute every 30 minutes, using names designed to imitate legitimate Microsoft Edge update processes and blend into routine administrative activity.

Malware Downloader Expands the Infection

The role of Secs.exe is to act as a downloader and launcher for additional malicious payloads.

After execution, the malware establishes a connection to an attacker-controlled FTP server and retrieves more files, placing them in the system's temporary directory before launching them automatically.

To strengthen persistence, the downloader creates another fake Edge update scheduled task, increasing the likelihood that at least one malicious component survives system reboots or security cleanup attempts.

The malware also collects extensive system intelligence and sends it back to the attackers. Information transmitted includes:

• Public IP address
• Geographic location and country
• Windows operating system version
• Processor details
• Installed memory (RAM)
• Username
• Hostname

This information allows the attackers to inventory compromised systems and prioritize valuable targets for future operations.

Monero Cryptocurrency Miner Hijacks System Resources

One of the downloaded payloads is MicrosoftEdgeUpdate.exe, a file masquerading as a legitimate browser update utility.

Instead of performing software updates, the executable functions as a cryptocurrency miner focused on generating Monero (XMR), a privacy-oriented digital currency frequently favored by cybercriminals.

To evade analysis and detection, the miner is protected using both the commercial protector Themida and a custom LZSS-based packer.

Once active, the malware exploits available CPU resources to mine cryptocurrency and communicates with public mining pools, including Nanopool and Kryptex. It also reports successful mining activity back to attacker infrastructure.

Victims may experience:

• Significantly higher CPU utilization
• Server slowdowns
• Increased electricity consumption
• Reduced application performance
• Wasted infrastructure resources

For organizations operating database servers, these effects can significantly impact business-critical workloads.

Gh0st RAT Provides Full Remote Control

The second major payload, winlogon.exe, is a variant of the notorious Gh0st RAT malware family.

Unlike the cryptominer, which focuses solely on generating revenue, Gh0st RAT provides attackers with persistent remote access and broad administrative control over compromised systems.

The malware establishes persistence through three separate mechanisms:

1. Windows Run registry entries
2. Windows services
3. Scheduled tasks

Once deployed, Gh0st RAT enables attackers to perform a wide range of malicious activities, including:

• Keystroke logging
• File management and manipulation
• Remote command execution
• Interactive command shell access
• Event log deletion
• Data theft

Researchers also observed functionality specifically designed to steal information from QQ, a popular Chinese messaging platform.

The RAT supports more than 30 remote-control commands and can be extended through additional plugins that provide capabilities such as screen capture and full remote desktop access.

To avoid detection, the malware actively checks for the presence of 78 security-related processes associated with antivirus and endpoint security products.

Although Fortinet researchers were unable to fully analyze its command-and-control communications because the servers were offline during testing, the malware's code and behavior closely resemble previous MSSQL-targeting threats, including HiddenGh0st, another Gh0st RAT-based malware family.

Defending Against MSSQL Credential Attacks

Organizations should treat internet-exposed SQL Server systems as high-risk assets and implement layered security controls to reduce exposure.

Recommended defensive measures include:

• Remove direct internet exposure wherever possible.
• Place SQL Server instances behind VPN gateways, jump hosts, or firewalls.
• Block inbound access to TCP port 1433 from untrusted networks.
• Enforce long, complex, and unique passwords for all SQL accounts.
• Rename or disable the default sa administrator account.
• Configure account lockout policies to mitigate brute-force attacks.
• Disable xp_cmdshell unless there is a verified operational requirement.
• Monitor for newly created scheduled tasks, particularly those impersonating Microsoft Edge or Windows update services.
• Investigate unexpected files appearing in C:\Users\Public or temporary directories.
• Monitor CPU utilization spikes that may indicate unauthorized cryptocurrency mining.
• Deploy endpoint detection and response (EDR) solutions capable of identifying credential attacks and abnormal SQL Server activity.

Recent incidents involving attackers deploying command-and-control frameworks, remote access malware, ransomware, and cryptominers on compromised MSSQL infrastructure demonstrate that exposed database servers continue to be a lucrative and heavily targeted attack surface. Organizations that fail to secure these systems risk both operational disruption and long-term compromise of sensitive business data.