Hackers Deploy Gh0st RAT and Monero Miner on SQL Servers

FortiGuard Labs disclosed on November 12, 2026, that attackers had been breaking into internet-facing Microsoft SQL Server databases since at least early October 2026 by trying more than 2,700 common passwords.

The operation, publicly reported on November 12–13, did not require a zero-day exploit. FortiGuard Labs said the campaign “leans on weak credentials and misconfigurations rather than sophisticated vulnerabilities,” leaving exposed servers and guessable credentials to do most of the work.

How did attackers breach exposed SQL Server databases?

• Reconnaissance: Attackers used Naabu, a scanner written in Go, to sweep the internet for SQL Server instances reachable from outside.
• Credential attack: A .NET-based tool tried more than 2,700 common passwords against each discovered instance until a login succeeded.
• Post-login access: The attackers ran malicious T-SQL commands, SQL Server’s query language, to enable xp_cmdshell, which passes instructions from the database to the underlying operating system.

That bridge turned a database meant to store records into a launch point for administrative commands across the underlying server, expanding a single credential failure into operating-system access.

What payloads did the attackers deploy?

The first payload was an XMRig-based cryptocurrency miner for Monero. It ran under the filename MicrosoftEdgeUpdate.exe, a deliberately ordinary-looking name that could pass unnoticed in a list of running processes. The malware consumed the server’s CPU capacity and connected to mining pools; researchers identified nanopool and kryptex among its destinations.

The second payload was a Gh0st RAT variant, a remote access trojan that gave operators broad control over the infected machine. Its command set covered more than 30 functions, including file management, keylogging, screen capture, remote desktop access and theft of credentials for QQ, a messaging platform.

Both payloads built persistence into their operation through registry modifications and scheduled tasks. A basic reboot would not evict either tool. Administrators who check only for active mining processes could miss the RAT and its mechanisms for surviving cleanup.

What remains unknown about the campaign?

The malware phoned home to command-and-control domains including server.vietnam852[.]com and www.swordaa[.]com for instructions. By the time FortiGuard researchers dug in, several components had already gone dark.

The disclosure provides no confirmed victim count. Researchers found Chinese-language traits in the malware, but that was the only pointer beyond technical indicators. FortiGuard has not tied the campaign to any specific actor.

What can organizations do to contain the compromise?

Organizations operating SQL Server have three immediate controls:

• Replace default, shared or guessable credentials with strong, unique passwords, which can defeat the dictionary of more than 2,700 common passwords.
• Remove internet-facing database instances from public reach, so scanners cannot include them in their list of exposed targets.
• Leave xp_cmdshell disabled unless a documented business need requires it, closing the bridge between database queries and operating-system commands.
• Hunt for MicrosoftEdgeUpdate.exe consuming abnormal CPU on database servers, unexpected scheduled tasks, unusual registry entries and outbound connections to nanopool or kryptex.

Those steps contain the immediate compromise, but they do not address the broader security consequence. A Gh0st RAT can capture keystrokes and screens, steal credentials and turn one compromised database into a foothold across an entire network.

The miners consume computing resources; the remote-access trojan supplies a path to wider compromise. Security teams that remove only the miner without hunting the RAT may leave the original operators on the host.

The disclosure sets no remediation deadline, leaving a live response window until operators remove both payloads, disable persistence and investigate whether stolen credentials reached other systems.