A hacking campaign is compromising exposed Microsoft SQL Server databases and installing two pieces of malware: a Monero cryptocurrency miner and a remote access trojan known as Gh0st RAT.
FortiGuard Labs disclosed the operation on November 12, 2026. The campaign has been active since at least early October 2026. The attackers exploit weak credentials rather than sophisticated vulnerabilities, using brute-force techniques against databases exposed to the internet.
Attack methodology
The campaign begins with reconnaissance using Naabu, a scanner written in Go, to identify reachable SQL Server instances. Attackers then deploy a .NET-based tool that cycles through more than 2,700 common passwords until gaining access.
Once inside, the attackers execute malicious T-SQL commands to enable xp_cmdshell, a feature that allows the database to pass instructions directly to the underlying operating system. This converts a database server into a platform for running administrative commands across the entire system.
Two payloads with distinct functions
The first payload is a cryptocurrency miner built on XMRig that mines Monero while disguised as MicrosoftEdgeUpdate.exe. The miner connects to pools including nanopool and kryptex, consuming the victim's CPU resources.
The second payload is a variant of Gh0st RAT that supports more than 30 commands, including file management, keylogging, screen capture, remote desktop access, and theft of credentials for the QQ messaging platform.
Both payloads establish persistence through registry modifications and scheduled tasks to survive system reboots.
Infrastructure and attribution
The malware communicates with command-and-control servers using domains including server.vietnam852[.]com and www.swordaa[.]com. Several components were no longer active by the time researchers analyzed the campaign.
No confirmed victim count has been reported. Attribution remains limited to technical indicators and Chinese-language traits found in the malware. FortiGuard Labs has not linked the campaign to any specific threat actor.
Mitigation and detection
Organizations can defend against this campaign by enforcing strong, unique credentials for SQL Server accounts, removing databases from public internet access, and keeping xp_cmdshell disabled by default.
Security teams can hunt for indicators including processes named MicrosoftEdgeUpdate.exe consuming significant CPU on database servers, unexpected scheduled tasks, unusual registry entries, and outbound connections to known mining pools.
Researchers warn that the remote access trojan poses a greater risk than the miner alone. A RAT capable of logging keystrokes, capturing screens, and stealing credentials could provide attackers with a foothold to compromise entire networks. Organizations that remove the miner without fully eliminating the trojan may leave attackers in place.
