Skip to content
SQL Server Exploited via Weak Passwords for Cryptomining and RAT Deployment

SQL Server Exploited via Weak Passwords for Cryptomining and RAT Deployment

First seen 12 Nov 2026, 16:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 16:50 UTC
  • •Attackers exploit weak passwords on SQL Server instances to deploy malware.
  • •The campaign uses a Go-based payload and the Naabu port scanner for reconnaissance.
  • •Malware includes a Monero cryptominer and a Gh0st RAT variant for remote access.

A cybersecurity campaign is targeting internet-facing Microsoft SQL Server instances using weak passwords to deploy a Monero cryptominer and Gh0st remote access trojan (RAT). Discovered by FortiGuard Labs in early October 2026, the attackers utilize a Go-based payload that includes the Naabu port scanner to identify vulnerable servers on TCP port 1433. Once access is gained through brute-force attacks on common usernames like 'sa' and 'admin', malicious T-SQL commands are executed to download and run additional malware. The campaign has been rated high severity, although the exact number of compromised servers remains undisclosed. The malware establishes persistence by scheduling tasks and modifying registry keys. Security experts recommend removing direct internet access to SQL Server and enforcing strong credentials to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-10-01
Campaign discovered by FortiGuard Labs
FortiGuard Labs identified an active campaign targeting SQL Server instances with weak passwords.
Infosecurity-Magazine
2026-11-12
Research published on SQL Server vulnerabilities
FortiGuard Labs published findings detailing the attack methods and malware used in the SQL Server exploitation campaign.
Csoonline

More articles in this cluster (4)

Following this threat?

Track Gh0st RAT in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

What are the main attack vectors?
The attackers use brute-force password attacks on SQL Server instances exposed to the internet.
What types of malware are being deployed?
The campaign deploys a Monero cryptominer and a Gh0st RAT variant for remote access.
How can organizations protect against this threat?
Organizations should enforce strong, unique passwords and restrict internet access to SQL Server instances.