Exposed SQL Servers Hit With Monero Miner and Gh0st RAT

Attackers compromised exposed Microsoft SQL Servers and abused the xp_cmdshell feature to deploy two payloads: a Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant named winlogon.exe, according to analysis from FortiGuard Labs published five weeks after the activity was first spotted.

The campaign has not been attributed to a specific actor. PANews, citing Crypto Briefing, stated plainly that no operator has been named, and Crypto.news noted that its publication does not identify the attackers.

How does the attack chain work?

Microsoft's documentation says xp_cmdshell is disabled by default on new SQL Server installations and should stay off in most cases. Commands issued through the feature inherit the security permissions of the SQL Server service account. Microsoft recommends enabling it only while a required task runs, restricting access to highly privileged users, or using a less-privileged proxy account for non-administrators. The company also warns that enabling or using xp_cmdshell can trigger audit tools.

From that shell, a downloader retrieves the two payloads from an attacker-controlled server:

• MicrosoftEdgeUpdate.exe — the mining component, which uses the machine's CPU to mine Monero through XMRig. Its configuration contains a wallet address and three mining pool addresses.
• winlogon.exe — a Gh0st RAT variant with keylogging, file management and remote command functions. Screen capture and remote desktop are supplied through plugins that were not present in the analyzed sample.

Persistence comes from registry entries, a Windows service and scheduled tasks. The RAT's scheduled task runs every 30 minutes, according to Zhang's analysis. Researchers examined the RAT without connecting to a live command server because that infrastructure had already been taken offline before analysis began.

Both outlets describe the same two payloads and the same xp_cmdshell abuse vector.

Why does one server serve two purposes?

Exposed databases remain one of the cheapest ways for attackers to acquire processing power. This campaign shows a single server can generate quiet mining revenue while providing a persistent foothold for data theft. The payload naming is the giveaway — a program labeled as an Edge updater has no ordinary reason to run on a database server.

The pattern has precedents. In July 2024, attackers used vulnerable file-sharing servers to spread Monero miners and remote-access malware, with AhnLab documenting XMRig, XenoRAT and Gh0stRAT installations on Rejetto HTTP File Server and at least four attacker groups, including LemonDuck. In August 2026, Apple patched a macOS flaw after Screen Sharing was exploited to install Monero miners; the Netherlands' National Cyber Security Centre confirmed intrusions on multiple systems in an Aug. 12 advisory. A January 2025 CrowdStrike recruitment scam also delivered XMRig through a fake job-application download.

What comes next?

FortiGuard Labs has not published a victim count or named the operators, so the next meaningful data point is whether other security firms corroborate the campaign and attach a number to it. Microsoft's guidance — keep xp_cmdshell disabled unless a specific task requires it — remains the practical control for database administrators.

The campaign's economics depend on mining quietly on hosts the operators do not own, which is why detection usually comes from server administrators noticing CPU load rather than from the blockchain itself. FortiGuard's report leaves the size of the operation an open question for now.

Market data timestamped Nov. 14, 2026, 12:38 UTC by CoinPaprika showed Monero at $535, up 0.3% over 24 hours and down 12.6% over seven days, with a market cap of $10.08 billion and 24-hour volume of $115.5 million. Bitcoin stood at $67,196, down 2.9% on the day and 11.4% on the week.