Back Gbhackers

Threat Actors Target MS

Gbhackers •Mayura Kathir • March 24, 2026

Threat actors are continuing to aggressively target Microsoft SQL (MS-SQL) servers in 2026, with new evidence showing the deployment of a scanner malware known as ICE Cloud Client. Larva-26002 has maintained a consistent focus on poorly secured MS-SQL servers exposed to the internet. These systems are typically compromised through brute-force or dictionary attacks using weak […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Persistent Attacks on Microsoft SQL Servers by Larva-26002 Using ICE Cloud Client In 2026, threat actor Larva-26002 has been targeting poorly secured Microsoft SQL (MS-SQL) servers, deploying a scanner malware known as ICE Cloud Client. This campaign has been active since at least January 2024, focusing on systems exposed to the internet. The attackers utilize brute-force and dictionary attacks to compromise these servers, often exploiting weak passwords. The current status indicates ongoing attacks with upgraded tools being deployed in each cycle. The scope of impact includes a significant number of MS-SQL servers that remain vulnerable due to inadequate security measures. As of March 2026, the campaign continues without any reported mitigation efforts from affected organizations. Security professionals are advised to enhance their defenses against these targeted attacks. 3 sources 67

Extracted Entities

Threat Actors Target MS

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)