Hackers Hijack Microsoft SQL Servers Using T

An active campaign in early October 2026 that targets Internet-facing Microsoft SQL Server instances.

The entry point is dllhost.exe, a Go binary packed with UPX that embeds the open-source Naabu v2 port scanner.

It requests a target range from hxxp://site.vietnam852[.]com:88/ip.php and converts the returned address into a hardcoded /16 CIDR block.

Naabu then sends TCP SYN probes to port 1433 on random addresses in that block and writes responsive hosts to %temp%\Result.txt. After each range, the malware requests a new one.

The binary also downloads eight support files into %Temp%: 2018.sql, dwm.exe, go.bat, go.vbs, out.bat, user.txt, pass.txt and sqlcmd.exe.

For persistence it creates a scheduled task that runs every 30 minutes. The task name imitates a Microsoft Edge Update task: MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2}.

The script go.vbs launches go.bat, which uses findstr.exe to look for open hosts and then starts dwm.exe. Despite the Windows-style name, dwm.exe is a .NET tool whose assembly name is CSQL.exe.

It runs a brute-force attack against each listed host. It draws on user.txt, which holds accounts such as sa and admin, and on pass.txt, which holds more than 2,700 passwords. It runs up to 500 threads.

After a successful login, a second dwm.exe instance executes 2018.sql in GO-separated batches. The script enables xp_cmdshell, which gives the attacker operating-system command execution from inside the database.

It then downloads down.exe into C:\Users\Public, renames it Google.exe or payload.exe, and runs it. It also creates a daily task named Microsoft_UPDATES.

A separate batch extracts an embedded executable from the @DATA variable to Secs.exe and copies it to the Startup folder.

FortiGuard Labs observed that , the attackers guess credentials, then use native T-SQL commands to push a Monero miner and a Gh0st RAT variant onto compromised hosts.

Microsoft SQL Servers Hijacked

All these executables are variants of one downloader. Secs.exe pulls files one at a time from ftp.vietnam852[.]com using FtpGetFileW() and runs each with ShellExecuteW().

It adds another Edge-themed task, MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}, which runs daily at 01:00.

It also sends an HTTP POST that registers the host with the backend. The registration data includes public IP, country, Windows edition, CPU and RAM, installation time, user name and host name.

The first payload, MicrosoftEdgeUpdate.exe, is protected by Themida and a custom LZSS packer. It is a Monero miner that uses the victim’s CPU.

Its traffic goes to xmr-ru.kryptex.network, and it reports mining status to the attacker through an HTTP GET with the user agent “XMRig Reporter”.

The second payload, winlogon.exe, is a Themida-protected Gh0st RAT variant . Its command-and-control servers were already offline during analysis, so researchers could examine only the unpacked sample statically.

It persists through the HKLM Run key, a Windows service, and a 30-minute scheduled task. It has two hardcoded C2 endpoints: server.vietnam852[.]com:8000 and

The RAT supports more than 30 control commands. They cover keylogging, file transfer, download-and-execute, process and service management, registry edits, and event-log clearing.

Screen capture and remote desktop come from plugins. It fingerprints the host and checks for 78 security-product process names, including MsMpEng.exe, avp.exe and 360tray.exe.

It also steals QQ data from the \Tencent\Users directory. Together these features suggest a Chinese-language malware lineage reused for both espionage-style access and monetization.

Defenders should never expose port 1433 to the Internet. They should rename or disable the sa account, enforce long unique passwords with lockout policies, and keep xp_cmdshell disabled.

Teams should hunt for Edge-update tasks that point to C:\Users\Public or E:, for Secs.exe, Google.exe and payload.exe, and for traffic to vietnam852[.]com. Any server where xp_cmdshell was enabled unexpectedly should be treated as compromised.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Hackers Manipulate NVIDIA GPU Monitoring to Conceal Cryptocurrency Mining on Compromised Linux Servers

FBI Disrupts North Korean FaceStealer Attacks Linked to $400 Million in Crypto Theft

Hackers Exploit ChatGPT and Claude Website Typos to Deliver Malware and Hijack Browsers

Hackers Disguise XLoader Malware as Purchase Order Confirmations to Infect Windows Computers

Hackers Exploit Check Point PHP2Shell Flaws to Gain Root Access and Deploy Wiper Malware

OpenAI Launches Advanced AI Cybersecurity Tools for Automated Penetration Testing and Vulnerability Research