An active campaign is breaking into exposed Microsoft SQL Server systems by guessing passwords, then using administrative commands to plant a Monero miner and a Gh0st RAT variant on the underlying Windows machines. The attack does not hinge on a fancy exploit. It rides on public-facing servers, weak credentials and the permissions that come with a successful login.
The activity matters now because the malware is already scanning for systems with TCP port 1433 open, the default Microsoft SQL Server port, and then trying usernames such as sa and admin with a password list that contains more than 2700 entries. Once inside, the operators use Transact-SQL commands from a file named 2018.sql to enable xp_cmdshell, which lets them run commands on the host, drop files into C:\Users\Public and pull down more tools from FTP infrastructure.
Xiaopeng Zhang shared the disclosure with CSO ahead of publication on Thursday, and the details show a campaign built for scale rather than sophistication. A Go-based payload named dllhost.exe retrieves target IP ranges from an attacker-controlled server, converts them into CIDR ranges and scans random addresses for open TCP port 1433. When it finds a reachable server, a separate executable named dwn.exe starts the brute-force attempt, records the IP address and, after a successful login, launches the next stage.
That next stage is what turns a database misconfiguration into a broader compromise. The malicious SQL commands enable xp_cmdshell and use it to download or extract executables into the server and run them. FortiGuard observed one payload, MicrosoftEdgeUpdate.exe, posing as a browser update while actually serving as an XMRig-based miner that uses the server’s CPU resources to mine Monero. The same campaign also delivers a Gh0st RAT variant, giving the attackers remote access after the login hurdle is cleared.
The weak point is not a secret flaw in Microsoft SQL Server. It is the combination of internet exposure and standing credentials. Shane Barney said relying on static, standing credentials turns exposure into a critical vulnerability, while Jason Soroko urged organizations to remove direct internet access to SQL Server, limit connections to approved systems, enforce strong unique passwords and keep xp_cmdshell disabled unless it is truly needed. The unanswered question is how many servers have already been compromised and where they sit, but the mechanics of the campaign leave little doubt about the risk: once the login is won, the server becomes the doorway.
