Hackers Hijack Microsoft SQL Servers to Deliver Gh0st RAT and Monero Miners

Attackers are hijacking internet-exposed Microsoft SQL Server instances to deploy a Monero cryptominer and a variant of Gh0st RAT, according to research from FortiGuard Labs. The campaign relies on weak credentials and misconfiguration rather than sophisticated vulnerabilities, the researchers emphasized.

The intrusion chain begins with reconnaissance. Operators use Naabu, a port scanner written in Go, to sweep the internet for SQL Server instances reachable from outside the network perimeter. A .NET-based brute-force tool then cycles through a dictionary of more than 2,700 common passwords until one produces a working login.

What happens after the login?

With access secured, the attackers execute malicious T-SQL commands — the query language SQL Server speaks — to enable xp_cmdshell, a feature that lets the database pass instructions directly to the underlying operating system. A server built to store records becomes a launchpad for administrative commands across the entire machine.

From there, the operators drop two payloads with distinct business models.

The first is a cryptocurrency miner built on XMRig, mining privacy coin Monero. It runs under the filename MicrosoftEdgeUpdate.exe, chosen precisely because it looks unremarkable in a process list. The miner consumes the victim's CPU and connects to mining pools; FortiGuard Labs identified nanopool and kryptex among the destinations.

The second payload is a variant of Gh0st RAT, a remote access trojan that gives the attacker broad control over the infected host. This version supports more than 30 commands, covering file management, keylogging, screen capture, remote desktop access, and theft of credentials for QQ, a Chinese messaging platform.

Both payloads are built to persist. They establish a foothold through registry modifications and scheduled tasks, meaning a simple reboot won't evict them.

Who is behind it, and how big is it?

The command-and-control infrastructure relied on domains including server.vietnam852[.]com and www.swordaa[.]com — the servers the malware contacts for instructions. By the time researchers investigated, several components had already gone dark.

Attribution remains thin. No victim count has been confirmed, and the only pointer beyond technical indicators is Chinese-language traits found in the malware itself. FortiGuard Labs has not tied the campaign to any specific actor.

What should defenders do?

The fixes are unglamorous but effective. Strong, unique credentials defeat a 2,700-password dictionary outright. Keeping SQL Server instances off the public internet removes them from Naabu's scanner results entirely. Leaving xp_cmdshell disabled closes the bridge between the database and the operating system.

Hunting guidance is concrete. A process named MicrosoftEdgeUpdate.exe consuming heavy CPU on a database server warrants scrutiny, as do unexpected scheduled tasks, unusual registry entries, and outbound connections to pools like nanopool or kryptex.

The bigger risk isn't the miner. A RAT that logs keystrokes, captures screens, and steals credentials can turn one compromised database into a foothold across an entire network — and security teams that clean up the miner without hunting for the trojan may find the attackers never really left.