FortiGuard Labs Flags SQL Server Attacks with Monero Miner, Gh0st RAT

FortiGuard Labs has identified an attack campaign targeting internet-facing Microsoft SQL Server systems with a Monero cryptominer and a Gh0st RAT variant, with the number of victims still unknown. The security research arm of Fortinet disclosed the activity this week. The campaign has been underway since at least early October 2026, according to the company's analysis.

The attackers gained access through brute force, exploiting weak passwords and configuration errors on exposed SQL Server instances. Once inside, they enabled xp_cmdshell, the SQL Server extended stored procedure that allows operating-system commands to execute from the database engine. That procedure is disabled by default in modern SQL Server installations; its reactivation signals that the operators had sufficient database privileges to reconfigure the host.

What payloads were deployed?

Two distinct payloads anchor the operation. The first is a Monero miner disguised as MicrosoftEdgeUpdate.exe, a file name that mimics a legitimate Microsoft Edge browser update binary. Cryptominers of this type convert compromised server capacity into hashing power for the privacy-oriented Monero network, in effect stealing electricity and compute from the victim organization.

The second payload is a variant of Gh0st RAT, a remote access trojan with a long history in the criminal tooling ecosystem. FortiGuard Labs says this variant can record keystrokes and capture screenshots. Those two functions give an attacker sustained visibility into operator activity on the compromised host, a capability that extends well beyond the financial motive of cryptomining.

How does the malware persist?

Persistence does not depend on a single mechanism. Registry changes and scheduled tasks keep both payloads running across reboots and user sessions, according to the research. Scheduled-task persistence is a common technique because it abuses a legitimate Windows administration feature rather than an exploitable software flaw.

The combination is operationally significant. A miner provides immediate monetization, while spyware capabilities offer longer-term intelligence value. Organizations running exposed SQL Server instances face both resource theft and potential data exposure from a single intrusion.

What remains unknown?

FortiGuard Labs has not confirmed how many systems the campaign has compromised. The activity also has not been attributed to a specific threat actor. Both gaps matter: without a victim count, the scale of the operation cannot be measured, and without attribution, defenders cannot map the infrastructure or motivations of the operators with confidence.

The disclosure nonetheless gives security teams a concrete checklist. Internet-facing SQL Server instances, weak administrative passwords, and an unexpectedly enabled xp_cmdshell procedure are the campaign's entry markers. Infection indicators include an unexpected MicrosoftEdgeUpdate.exe binary, unfamiliar scheduled tasks, and suspicious registry modifications.

What should administrators do now?

The remediation path follows directly from the attack chain. Administrators should restrict SQL Server exposure to the internet, enforce strong credential policies, and verify that xp_cmdshell remains disabled unless a documented business requirement exists. Monitoring for the disguised miner binary and for unexplained scheduled tasks would detect post-compromise activity.

FortiGuard Labs has not announced a deadline for updated detections or further technical publications on the campaign. Until the victim count and attribution are established, the full operational footprint of this SQL Server campaign remains an open question.