Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

Publisher excerpt From CSO Online

An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems. The activity highlights the persistent challenge of securing privileged access across complex and often legacy infrastructure, said Shane Barney, chief information security officer at Keeper Security. “While internet-facing databases are sometimes the unintended result of technical debt or misconfigurations, relying on static, standing credentials is what turns that exposure into a critical vulnerability,” he said. “When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit.” The campaign delivers two distinct payloads: an XMRig-based Monero cryptocurrency miner that hijacks the compromised servers’ computing resources, and a Gh0st remote access trojan (RAT) variant that gives attackers remote access and capabilities such as keylogging and data theft. Microsoft did not immediately respond to a request for comment. Brute-forcing SQL logins to get Windows commands The campaign begins with a Go-based payload named “dllhost.exe,” which runs the open-source Naabu port scanner, FortiGuard researcher Xiaopeng Zhang said in a disclosure shared with CSO ahead of its publication on Thursday. The payload retrieves target IP ranges from an attacker-controlled server, converts them into CIDR ranges, and scans randomly generated addresses for systems with TCP port 1433 open. This is the default port used by Microsoft SQL Server. Once reachable servers are identified, the malware records their IP addresses and launches a brute-force attack using a separate executable named “dwn.exe.” The tool attempts to authenticate with usernames such as “sa” and “admin,” alongside a predefined password list containing more than 2700 entries. Successful logins give attackers more than database access, Zhang said. The malware executes a series of malicious T-SQL commands contained in a file named 2018.sql, using SQL Server’s administrative functionality to run commands on the compromised Windows machine. Among other things, the commands enable xp_cmdshell, a SQL Server feature that allows database administrators to execute Windows command shell operations. The attackers then use it to download or extract executables into the server’s “C:\Users\Public” directory and run them. Jason Soroko, senior fellow at Sectigo, said the campaign effectively turns a database login into a way to execute malware on the server. “Organizations should remove direct internet access to SQL Server, restrict connections to approved systems, and enforce strong, unique credentials,” he said. “Administrative access should be limited to ac…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.