Persistent Attacks on Microsoft SQL Servers by Larva-26002 Using ICE Cloud Client

• •Larva-26002 targets poorly secured MS-SQL servers using ICE Cloud Client malware.
• •The campaign has been active since January 2024 and continues into 2026.
• •Brute-force and dictionary attacks are the primary methods of compromise.

In 2026, threat actor Larva-26002 has been targeting poorly secured Microsoft SQL (MS-SQL) servers, deploying a scanner malware known as ICE Cloud Client. This campaign has been active since at least January 2024, focusing on systems exposed to the internet. The attackers utilize brute-force and dictionary attacks to compromise these servers, often exploiting weak passwords. The current status indicates ongoing attacks with upgraded tools being deployed in each cycle. The scope of impact includes a significant number of MS-SQL servers that remain vulnerable due to inadequate security measures. As of March 2026, the campaign continues without any reported mitigation efforts from affected organizations. Security professionals are advised to enhance their defenses against these targeted attacks.