A hacking campaign is breaking into internet-facing Microsoft SQL Server databases and leaving behind two unwelcome tenants: a Monero miner and a remote access trojan.
FortiGuard Labs disclosed the operation on November 12, 2026. The attackers didn’t need a clever zero-day exploit. They mostly needed server owners to pick bad passwords.
The campaign has been active since at least early October 2026, according to the researchers. Public reporting followed on November 12–13, 2026.
How the break-in works
The attack starts with reconnaissance. The operators use Naabu, a scanner written in the Go programming language, to sweep the internet for SQL Server instances that are reachable from outside.
Next comes the brute-force stage. A .NET-based tool cycles through more than 2,700 common passwords, trying each one until a login works.
Once inside, the attackers run malicious T-SQL commands. T-SQL is the query language SQL Server speaks, and here it’s used to switch on a feature called xp_cmdshell.
That feature lets the database pass instructions directly to the underlying operating system. A database that was supposed to store records suddenly becomes a launchpad for running administrative commands on the whole server.
FortiGuard Labs emphasized that the campaign leans on weak credentials and misconfigurations rather than sophisticated vulnerabilities.
Two payloads, two business models
The first payload is a cryptocurrency miner built on XMRig, mining Monero. It runs under the name MicrosoftEdgeUpdate.exe, a filename chosen to look boring enough that an administrator scrolling through running processes might not blink.
The miner eats the victim’s CPU power and connects to mining pools. Researchers identified nanopool and kryptex among the pools it talks to.
The second payload is a variant of Gh0st RAT, a remote access trojan that hands the attacker broad control over the infected machine.
This version supports more than 30 commands. The list covers file management, keylogging, screen capture, remote desktop access, and theft of credentials for QQ, a messaging platform.
Both payloads are built to stick around. They establish persistence through registry modifications and scheduled tasks, so a simple reboot won’t evict them.
The infrastructure and the attribution question
The command-and-control setup relied on domains including server.vietnam852[.]com and www.swordaa[.]com. These are the servers the malware phones home to for instructions.
By the time researchers dug in, several components had already gone dark.
No victim count has been confirmed. Attribution also stays thin: the only pointer beyond technical indicators is Chinese-language traits found in the malware.
FortiGuard Labs has not tied the campaign to any specific actor.
What this means
For organizations running SQL Server, the obvious fixes are the unglamorous ones. Strong, unique credentials defeat a 2,700-password dictionary. Keeping databases off the public internet removes them from the scanner’s list entirely. Leaving xp_cmdshell disabled closes the bridge from database to operating system.
Defenders also have concrete signals to hunt for. A process called MicrosoftEdgeUpdate.exe chewing through CPU on a database server deserves a second look. So do unexpected scheduled tasks, unusual registry entries, and outbound connections to mining pools like nanopool or kryptex.
The bigger risk for victims isn’t the miner. A RAT that logs keystrokes, captures screens, and steals credentials can turn one compromised database into a foothold across an entire network.
Security teams that clean up the miner without hunting for the trojan may find the attackers never really left.