ChainCatcher report, according to Crypto Briefing, FortiGuard Labs has disclosed an attack campaign targeting Microsoft SQL Server databases exposed to the internet. Attackers exploited weak passwords and misconfigurations to breach servers via brute force, enabled the xp_cmdshell feature, and deployed two malicious payloads: a Monero mining program disguised as MicrosoftEdgeUpdate.exe, and a Gh0st RAT variant capable of keylogging and screen capturing. Both payloads achieve persistence by modifying the registry and scheduled tasks. FortiGuard Labs stated that this activity has been active since early October 2026; the number of victims remains unconfirmed, and no specific threat actor has been attributed.
Hackers Exploit Microsoft SQL Servers to Deploy Gh0st RAT and Monero Miner
ChaincatcherShare
Summary
A recent security breach involved hackers exploiting exposed Microsoft SQL Server databases, using weak passwords and misconfigurations to deploy a Monero miner and Gh0st RAT. Attackers enabled the xp_cmdshell feature to install payloads, including a DeFi exploit disguised as MicrosoftEdgeUpdate.exe. The malware achieved persistence through registry modifications and scheduled tasks. Activity has been ongoing since early October 2026, with no confirmed attribution or victim count.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.