Attackers Hijack Exposed SQL Servers With Weak Passwords to Plant Miner, Trojan
Attackers are brute-forcing exposed Microsoft SQL Server installations and planting a Monero miner and a Gh0st remote access trojan, according to a FortiGuard disclosure. Microsoft itself was not breached. Security experts urge companies to cut internet access to the databases.
Attackers are breaking into internet-exposed Microsoft SQL Server installations by guessing weak administrator passwords, then planting a cryptocurrency miner and a remote access trojan, according to a disclosure from FortiGuard researcher Xiaopeng Zhang published Thursday, November 12, 2026. Microsoft hacked headlines miss the point: the targets are customers' own servers.
The campaign combines port scanning, password guessing and Transact-SQL (T-SQL) commands, the language SQL Server uses to run instructions. Microsoft did not immediately respond to a request for comment.
How the attack works
It starts with a Go-based payload named dllhost.exe, which runs the open-source Naabu port scanner. The payload pulls target IP ranges from an attacker-controlled server and scans random addresses for open TCP port 1433, the default port for Microsoft SQL Server.
When it finds a reachable server, it records the address and launches a brute-force attack with a separate tool, dwn.exe. The tool tries usernames such as sa and admin against a predefined password list of more than 2700 entries.
A successful login gives attackers more than database access, Zhang said. The malware runs T-SQL commands from a file named 2018.sql. They enable xp_cmdshell, a feature that lets database administrators run Windows command shell operations.
The attackers then use it to download or extract executables into the server's C:UsersPublic directory and run them.
Two payloads
A loader retrieves more executables from the attackers' FTP infrastructure. One, MicrosoftEdgeUpdate.exe, poses as a legitimate browser update but is an XMRig-based miner. It uses the compromised server's processor to mine Monero and talks to mining pools using a wallet address embedded in its configuration.
The other is a variant of the Gh0st remote access trojan (RAT), delivered as Winlogon.exe. Researchers identified keylogging, file management, data theft, remote shell execution and process management. It also has more than 30 control commands, screen capture and remote desktop access.
What security experts advise
Jason Soroko, senior fellow at Sectigo, said the campaign effectively turns a database login into a way to execute malware on the server. He urged organizations to remove direct internet access to SQL Server and restrict connections to approved systems.
Soroko also called for strong, unique credentials and administrative access limited to accounts that need it. He recommended keeping xp_cmdshell disabled unless required and monitoring attempts to enable it.
Shane Barney, chief information security officer at Keeper Security, said internet-facing databases are sometimes the unintended result of technical debt or misconfigurations. In his view, relying on static, standing credentials is what turns that exposure into a critical vulnerability. When administrative logins can be brute-forced, he said, attackers can deploy malware "without needing a single complex exploit."
