Monero miners and Gh0st RAT target exposed SQL Servers

More than 2,700 preset database credentials formed the attack list against internet-facing Microsoft SQL Servers, according to a Nov. 12 FortiGuard Labs report by researcher Xiaopeng Zhang. The campaign installed a Monero miner and a Gh0st RAT remote-access variant after attackers used weak SQL Server passwords, FortiGuard said.

The malware could steal data and control compromised machines. FortiGuard discovered the activity in early October 2026. Its report did not identify the attackers or confirm a victim count.

Attack path

The tools searched for exposed databases and attempted logins with predefined credentials. Zhang's analysis found a password list of more than 2,700 entries paired with usernames including sa and admin.

After a successful login, the attackers ran database commands to enable xp_cmdshell and installed a downloader. That downloader retrieved the miner and RAT from an attacker-controlled server.

Why the database foothold mattered

Microsoft disables xp_cmdshell on new SQL Server installations and says it should generally remain switched off. The feature opens a Windows command shell from inside SQL Server.

Commands run by a database administrator through it inherit the security permissions of the SQL Server service account. Some older applications still need the feature, but Microsoft recommends enabling it “only while a necessary task runs.”

For nonadministrators, Microsoft recommends restricting access to highly privileged users and using a less-privileged proxy account. Without a configured proxy credential, the nonadministrator operation fails. Microsoft also warns that enabling or using xp_cmdshell can trigger security audit tools.

Payloads and persistence

• MicrosoftEdgeUpdate.exe, the mining payload, impersonated a Microsoft Edge updater while using the compromised server's CPU to mine Monero through XMRig. Its configuration contained one wallet address and three mining pool addresses, according to Zhang.
• winlogon.exe, a Gh0st RAT variant, supplied keylogging, file management and remote-command capabilities. Plugins supplied screen capture and remote desktop functions, but the analyzed sample did not contain them.
• Registry entries, a Windows service and scheduled tasks supported persistence. The RAT's scheduled task ran every 30 minutes.

Researchers examined the RAT without connecting it to a live command server because that infrastructure had shut down before analysis. That limitation constrained their view of the operators and the full command infrastructure.

Earlier and separate campaigns

In July 2024, attackers used vulnerable file-sharing servers to distribute Monero miners and remote-access malware, crypto.news previously reported. AhnLab's investigation documented installations of XMRig, XenoRAT and Gh0stRAT on Rejetto HTTP File Server.

AhnLab identified at least four attackers deploying mining software, including the LemonDuck group. The intruders collected system information, created backdoor accounts and, in many cases, terminated the file server after establishing access to keep other attackers out.

More recently, Apple patched a macOS flaw after attackers exploited Screen Sharing to install Monero miners. In an Aug. 12 advisory, the Netherlands' National Cyber Security Centre confirmed intrusions on multiple systems with an internet-reachable Screen Sharing port.

The agency said attackers obtained root access and installed a miner in every reported case. The advisory described an authentication weakness that allowed access without valid credentials. Apple made fixes available for macOS Sequoia, Sonoma and Tahoe.

In a separate campaign, CrowdStrike said fake recruitment offers in January 2025 directed job seekers to download an application presented as an employee management tool. CrowdStrike identified the operation on Jan. 7, 2025.

The download page offered Windows and macOS options, but both delivered a Windows executable written in Rust that fetched XMRig. Before proceeding, the application checked for debugging software, counted active processes and verified that the CPU had at least two cores.

After passing those checks, the application displayed a fake error message and continued downloading the miner. CrowdStrike said it “never requires candidates to download software as part of its recruitment process.”

What does this change for exposed SQL Server operators?

For system owners, the campaign turns weak credentials and exposed database access into an initial-access path. Microsoft's guidance points to keeping xp_cmdshell disabled outside narrow maintenance windows, limiting it to privileged users and applying a proxy account for nonadministrator use.

Defenders should also review audit records for xp_cmdshell, unexpected Windows services and scheduled tasks, and the two named executables. The Edge-update disguise broadens the set of processes operators need to inspect.

Going forward, the RAT's 30-minute scheduled-task interval sets a recurring window for security teams to detect and remove persistence from exposed environments.