Recent findings by FortiGuard Labs have unveiled a concerning cyber campaign targeting internet-exposed Microsoft SQL Servers. The study, led by researcher Xiaopeng Zhang and published on November 12, 2026, highlights a coordinated effort by attackers to infiltrate these servers. Once inside, they deploy Monero mining software and remote access malware capable of data theft and machine takeover.
summary
Attackers leverage weak database passwords to introduce Monero miners and Gh0st RAT variants into compromised systems. The miner masquerades as a Microsoft Edge update, effectively using the server’s processing capabilities for illicit cryptocurrency mining. Furthermore, registry modifications and Windows services are employed to facilitate sustained access to these infected environments.
Exploiting Weak Passwords in SQL Servers
The research indicates that the attackers initiate their campaign by probing public databases for vulnerable SQL Servers, utilizing a predefined set of credentials that includes over 2,700 possible password combinations alongside common usernames like “sa” and “admin.” After successful access, they enable the xp_cmdshell command to execute specific database commands which subsequently download the malicious software.
According to Microsoft documentation, the xp_cmdshell feature is disabled by default in new SQL Server installations, although it is still used in older applications. Microsoft advises caution in enabling this feature, as it allows database administrators to run operating system commands with the security permissions of the SQL Server service account, which can heighten security risks.
Monero Mining Under Disguise
Once installed, the mining software, labeled microsoftEdgeUpdate.exe, utilizes the CPU resources of the compromised machine for Monero mining via XMRig. Analysis revealed that the miner is configured with a specific wallet address along with three mining pool addresses to funnel the mined cryptocurrency. Additionally, the second payload, winlogon.exe, is identified as a variant of Gh0st RAT, equipped with functionalities for keylogging, file management, and remote command execution.
The report further discusses persistence mechanisms, detailing that the malware maintains its foothold through registry entries, Windows services, and scheduled tasks that run every 30 minutes.
Historical Context of Server Attacks
Past incidents have shown a pattern of similar attacks, where miners and remote access tools operate in tandem. For example, a previous attack documented in July 2024 targeted file-sharing servers, distributing both Monero miners and Gh0stRAT through exposed ports. Notably, the LemonDuck group was identified as one of the attackers, known for creating backdoor accounts while terminating services to deny other hackers access.
Moreover, in August 2024, a vulnerability within macOS allowed attackers to exploit screen-sharing functionalities for similar malicious operations. The Netherlands National Cyber Security Center confirmed that intruders managed to gain root access remotely, enabling them to install Monero miners on compromised systems.
Fake Recruitment Campaigns as a Vector
Another alarming trend involves impersonation campaigns, such as a January 2025 incident where CrowdStrike was targeted. Job seekers received emails that appeared to be from recruiters, directing them to download a supposed employee management tool. The tool ultimately downloaded the Monero miner disguised as benign software. The malicious application conducted preliminary checks on the system to ensure it could run effectively before proceeding with the download.
CrowdStrike emphasized that they would never ask candidates to download software during the hiring process, highlighting the importance of vigilance against such scams.
As cyberattacks continue to evolve, it is imperative for organizations to adopt robust security measures, particularly regarding the management of their SQL Server credentials and the monitoring of potentially harmful changes within their systems.
