Hackers target weak Microsoft SQL Server passwords to install a Monero miner and Gh0st RAT, using database features to run malware on Windows servers.
Attackers are targeting internet-exposed Microsoft SQL Server installations with password-guessing attacks, then using database administration features to install a Monero miner and Gh0st RAT on the underlying Windows servers.
Fortinet’s FortiGuard Labs identified the campaign in early October 2026. Its research describes an attack that relies on weak credentials rather than a newly identified software vulnerability.
The campaign combines cryptocurrency mining with remote access capabilities. While the miner consumes the server’s processing resources, the trojan gives attackers tools to monitor activity, access files and execute commands.
Finding servers and guessing passwords
According to Fortinet’s blog post, a Go-based component named dllhost.exe uses the open-source Naabu scanner to search for systems with TCP port 1433 open, the default port for SQL Server.
The malware receives IP addresses from its server, expands them into /16 network ranges and scans those ranges for accessible installations.
When the malware finds an open port, it launches another program, dwm.exe, which attempts to authenticate using usernames such as sa and admin and a list of more than 2,700 passwords.
These filenames resemble legitimate Windows components. In this campaign, however, they refer to the attackers’ programs, so the names alone are not enough to identify a malicious file.
Turning database access into Windows commands
After obtaining access, the attackers execute commands from a file named 2018.sql. The script uses Transact-SQL, Microsoft’s implementation of SQL, to enable xp_cmdshell, a feature that allows SQL Server to launch Windows commands.
This step requires sufficient database privileges. Microsoft documents that the feature is disabled by default. When a privileged SQL Server account uses it, the resulting Windows process runs with the permissions of the SQL Server service account.
A compromised database login does not automatically give attackers unrestricted control of Windows. The account’s database permissions and the privileges assigned to the SQL Server service determine what attackers can do.
In the campaign Fortinet examined, the script places malicious executables in the Windows Public folder. One of them, Secs.exe, acts as a downloader and connects to an attacker-controlled FTP server.
It retrieves and executes additional payloads, creates scheduled tasks for persistence and reports information about the infected machine, including its public IP address, country, Windows version, processor and RAM.
A fake browser update and a remote access trojan
One downloaded payload, MicrosoftEdgeUpdate.exe, impersonates a browser update component. It is actually a Monero miner that uses the server’s CPU to generate cryptocurrency for a wallet address embedded in the malware.
Another payload, named winlogon.exe, is a Gh0st RAT variant. Fortinet identified more than 30 control commands, with capabilities including keylogging, screen recording, file management and remote shell access. Additional functions, including remote desktop access, are supplied through plugins.
The RAT also establishes persistence through a registry entry, a Windows service and a scheduled task that launches it every 30 minutes.
Fortinet could not fully examine its live communications because the command-and-control server was offline when researchers analysed the sample. The identified capabilities therefore describe what the malware supports, rather than proving that attackers used every function on compromised servers.
Removing the miner does not resolve the compromise
Shane Barney, chief information security officer at Keeper Security, told Hackread.com that the campaign illustrates the risks of exposed administrative access.
“This campaign illustrates the persistent challenge IT and security teams face: securing privileged access across complex, and often legacy, infrastructure. While internet-facing databases are sometimes the unintended result of technical debt or misconfigurations, relying on static, standing credentials is what turns that exposure into a critical vulnerability. When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit.”
Jason Soroko, senior fellow at Sectigo, said the remote access trojan makes the incident more serious than resource theft alone.
“This campaign turns a database login into a way to run malware on the server. Attackers guess weak passwords, then use SQL Server’s administrative features to launch Windows commands. That makes the privileges of both the database account and the account running SQL Server central to the risk. The miner consumes resources, while the remote access trojan can steal information and maintain access. Removing the miner alone would leave the wider compromise unresolved.”
For administrators, the immediate priorities are restricting database access to approved systems, using strong and unique credentials, and limiting administrative permissions. Keeping xp_cmdshell disabled reduces unnecessary exposure, but teams should also monitor attempts to enable it.
Soroko recommended investigating SQL Server processes launching command shells, unexpected scheduled tasks and successful logins following repeated failures.
“A compromised server needs containment, a search for persistence and a review of exposed credentials before it returns to service.”
