Hackers Hijack Microsoft SQL Servers to Deploy Gh0st RAT and Monero Miners

How the SQL Server Break-In Works

The campaign begins with reconnaissance. The operators use Naabu, a scanner written in the Go programming language, to search the internet for Microsoft SQL Server instances that are accessible from outside an organization’s network.

After identifying potential targets, the attackers launch a brute-force attempt using a .NET-based tool that cycles through more than 2,700 common passwords. A successful login gives them access to the database environment without requiring an advanced software vulnerability.

Once inside, the attackers execute malicious T-SQL commands. T-SQL is the query language used by SQL Server, and in this campaign it enables a feature called xp_cmdshell. That feature allows the database to pass commands directly to the underlying operating system, turning a system intended to store records into a platform for running administrative commands on the server.

FortiGuard Labs said the campaign depends primarily on weak credentials and insecure configurations rather than sophisticated vulnerabilities. That approach can still be highly effective when SQL Server systems are exposed to the public internet or protected by reused and easily guessed passwords.

Two Payloads Serve Different Criminal Goals

The first payload is a cryptocurrency miner based on XMRig and configured to mine Monero. It operates under the name MicrosoftEdgeUpdate.exe, a filename designed to blend into ordinary system activity. The miner consumes the victim’s CPU resources and communicates with mining pools, including nanopool and kryptex, which were identified by researchers.

The second payload is a variant of Gh0st RAT, a remote access trojan that gives attackers broad control over an infected machine. The malware supports more than 30 commands, including file management, keylogging, screen capture, remote desktop access, and the theft of QQ messaging-platform credentials.

Both payloads are designed to survive a reboot. They create persistence through registry modifications and scheduled tasks, meaning that restarting the compromised server will not remove the malware or prevent it from returning.

Command-and-Control Infrastructure and Attribution

The malware’s command-and-control infrastructure included domains such as server.vietnam852[.]com and www.swordaa[.]com. These servers provide the channels through which the malware receives instructions from its operators.

Several components had already gone offline by the time researchers examined the activity. The number of victims has not been confirmed, and FortiGuard Labs has not linked the campaign to a specific threat actor.

The only indication beyond the technical evidence is the presence of Chinese-language traits in the malware. Those characteristics provide limited attribution value and do not establish who is behind the operation.

What Organizations Running SQL Server Should Watch For

The most effective defensive measures address the weaknesses the campaign exploits. Strong, unique credentials make a 2,700-password dictionary attack less likely to succeed. Removing databases from the public internet prevents them from appearing in the attackers’ scan results, while keeping xp_cmdshell disabled removes the direct bridge between the database and the operating system.

Security teams can also hunt for specific indicators of compromise. A process named MicrosoftEdgeUpdate.exe consuming significant CPU resources on a database server warrants investigation, particularly if it is not associated with legitimate software activity. Unexpected scheduled tasks, unfamiliar registry entries, and outbound connections to mining pools such as nanopool or kryptex are additional warning signs.

The broader danger is the Gh0st RAT, not simply the cryptocurrency miner. A remote access trojan capable of logging keystrokes, capturing screens, and stealing credentials can turn one compromised SQL Server into an entry point to other systems across an organization’s network.

Organizations that remove the miner without searching for the trojan and its persistence mechanisms may leave the attackers’ access intact.

Why This Matters

This campaign illustrates how exposed database infrastructure can be abused through basic security weaknesses rather than an undisclosed or highly complex vulnerability. A compromised SQL Server can provide both immediate financial value through cryptomining and longer-term access through surveillance, credential theft, and remote control.

The combination of a resource-consuming miner and a capable remote access trojan also means that incident response must go beyond deleting a suspicious executable. Defenders need to review registry changes, scheduled tasks, database activity, credentials, and outbound network connections to determine whether the attacker retained access or moved beyond the original server.

Frequently Asked Questions

How are attackers gaining access to SQL Server systems?

They scan the internet for externally reachable SQL Server instances and then use a .NET-based tool to test more than 2,700 common passwords. After gaining access, they use malicious T-SQL commands to enable xp_cmdshell.

What malware does the campaign install?

The campaign installs an XMRig-based Monero miner and a Gh0st RAT variant. The miner uses the filename MicrosoftEdgeUpdate.exe, while the RAT supports functions such as keylogging, screen capture, remote desktop access, file management, and QQ credential theft.

What are the main ways to reduce the risk?

Organizations should use strong, unique database credentials, keep SQL Server systems off the public internet where possible, and leave xp_cmdshell disabled. They should also investigate suspicious scheduled tasks, registry entries, high CPU usage from MicrosoftEdgeUpdate.exe, and connections to mining pools.