Back Cybersecuritynews

Threat Actors Continuously Attacking MS

Cybersecuritynews •Tushar Subhra Dutta • March 24, 2026

A persistent threat actor known as Larva-26002 has been continuously targeting poorly managed Microsoft SQL (MS-SQL) servers, this time deploying a new scanner malware called ICE Cloud Client. The campaign has been active since at least January 2024 and continues into 2026, with the attacker upgrading their tools with every cycle. What started as a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Attacks on Microsoft SQL Servers by Larva-26002 Using ICE Cloud Client In 2026, threat actor Larva-26002 has been targeting poorly secured Microsoft SQL (MS-SQL) servers, deploying a scanner malware known as ICE Cloud Client. This campaign has been active since at least January 2024, focusing on systems exposed to the internet. The attackers utilize brute-force and dictionary attacks to compromise these servers, often exploiting weak passwords. The current status indicates ongoing attacks with upgraded tools being deployed in each cycle. The scope of impact includes a significant number of MS-SQL servers that remain vulnerable due to inadequate security measures. As of March 2026, the campaign continues without any reported mitigation efforts from affected organizations. Security professionals are advised to enhance their defenses against these targeted attacks. 3 sources 67

Extracted Entities

Threat Actors Continuously Attacking MS

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (1)