Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware

A new campaign is guessing its way into internet-facing Microsoft SQL Server systems. The attackers use a list of more than 2,700 passwords and then install a cryptocurrency miner and a remote access trojan (RAT) on the hacked machines.

The campaign has been running since at least early October 2026. Database servers hold valuable data, so they are a favorite target. This campaign scans for exposed servers, tries many logins, and runs commands that pull in more malware.

Attackers have used the same basic approach for years, as seen when hackers were continuously attacking MS-SQL servers with scanner malware earlier this year.

Researchers at Fortinet’s FortiGuard Labs identified the malware and described the full infection chain in a report published on November 12, 2026.

Analyst Xiaopeng Zhang noted that the campaign abuses T-SQL, Microsoft’s extension of the SQL language, to run commands on hacked servers. FortiGuard rates the severity as high.

Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers

The chain starts with a file named dllhost.exe. It is written in the Go language and packed with UPX to hide its contents. The name copies a real Windows process, which helps it blend in.

The file contains the open-source Naabu port scanner. It contacts the attackers’ server, receives an IP range to scan, and checks each random address in that range for open TCP port 1433, the default port for SQL Server.

Any open host is written to a file called Result.txt, and the malware then asks for the next range. The malware also downloads eight support files, including scripts named go.vbs and go.bat and a tool named dwm.exe.

Despite its name, dwm.exe is a .NET program that guesses logins. It reads user names such as “sa” and “admin” from one file and tries more than 2,700 passwords from another, using up to 500 threads at once.

Weak or reused passwords on exposed servers are what make this work. This is the same weakness behind older cases where criminals brute force MSSQL logins to drop ransomware.

When a login works, the tool runs a file called 2018.sql on the server. Its commands turn on xp_cmdshell, a feature that lets SQL Server run Windows commands.

They then download a program into the C:UsersPublic folder and name it Google.exe or payload.exe. They also create a daily scheduled task called Microsoft_UPDATES and drop another file, Secs.exe, into the Startup folder.

The malware itself sets up a scheduled task that runs every 30 minutes and is named to look like a Microsoft Edge update.

What the Miner and Gh0st RAT Do After the Break-In

The downloader, Secs.exe, connects to an FTP server and pulls down more files, which it saves in the Temp folder and runs. It then creates another disguised Edge update task.

Next it sends the victim’s public IP address, country, Windows version, processor, memory, user name and host name to the attackers. This registers the server in their system.

One payload is MicrosoftEdgeUpdate.exe, which is not an update at all. It is a Monero miner protected by two packers, Themida and a custom LZSS packer.

It uses the server’s CPU to mine coins and connects to pools such as nanopool and kryptex. It also tells the attackers’ server when mining starts. The result is slow performance, higher power costs and wasted computing power for the victim.

The second payload, winlogon.exe, is a variant of Gh0st RAT, which gives attackers remote control. It sets itself up three ways: a Run registry key, a Windows service and a scheduled task.

It can log keystrokes, manage files, run a remote shell, wipe event logs and steal data from QQ, a Chinese messaging app. It also supports more than 30 control commands, and plugins add screen capture and remote desktop.

The malware checks for 78 security product process names. Its command servers were offline when Fortinet tested it, so the team could only study the unpacked file. The same family has been seen before, when HiddenGh0st malware targeting MS-SQL servers was reported.

Do not leave SQL Server open to the internet. Put it behind a firewall or VPN, and block port 1433 from outside networks. Use long, unique passwords, rename or disable the sa account, and lock accounts after repeated failures.

Turn off xp_cmdshell unless you need it. Watch for new scheduled tasks that imitate Edge updates, unknown files in C:UsersPublic, and sudden spikes in CPU use.

Recent reports of hijacking MS-SQL servers recently with C2 frameworks show that these servers remain a steady target.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs