Attackers Brute-Force Exposed SQL Servers to Deploy Monero Miner and Gh0st RAT
FortiGuard Labs disclosed on November 12, 2026 a campaign that breaks into internet-facing Microsoft SQL Servers using weak credentials and installs a Monero miner and a Gh0st RAT variant. Researchers say the attacks began in early October 2026 and have no confirmed victim count or attribution to a specific actor.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What FortiGuard Found
FortiGuard Labs disclosed on November 12, 2026 a campaign that compromises internet-facing Microsoft SQL Server databases and installs two payloads: an XMRig-based Monero miner and a Gh0st RAT variant. The firm says the activity has been running since at least early October 2026. The operation relies on weak credentials and misconfiguration rather than a software vulnerability.
The operators first scan for reachable SQL Server instances using Naabu, a Go-based scanner. A .NET tool then cycles through a list of more than 2,700 common passwords paired with usernames such as "sa" and "admin." Researcher Xiaopeng Zhang, in FortiGuard's report, notes that the password list is the core of the intrusion.
How the Access Becomes Control
Once logged in, the attackers run T-SQL commands that enable xp_cmdshell, a feature that lets SQL Server pass commands directly to the operating system. A downloader then retrieves the miner and the RAT from an attacker-controlled server. Microsoft's documentation states that xp_cmdshell is disabled by default on new installations and recommends keeping it off except while a specific task requires it.
Microsoft also says commands run through the feature inherit the permissions of the SQL Server service account, and that a non-administrator needs a configured proxy credential for the operation to succeed. The company warns that enabling or using the feature can trigger security audit tools. In this campaign, the enabling step is the point where a database login becomes host-level access.
Payloads and Persistence
The miner runs under the filename MicrosoftEdgeUpdate.exe and uses the host's CPU to mine Monero. Its configuration includes a wallet address and three mining pool addresses. Earlier FortiGuard-cited telemetry, as reported by Crypto Briefing, named nanopool and kryptex among the pools it contacts; Crypto.news reported the configuration as containing three pool addresses without naming them.
The second payload, winlogon.exe, is a Gh0st RAT variant. Crypto Briefing describes more than 30 supported commands covering file management, keylogging, screen capture, remote desktop, and theft of QQ messaging credentials. Crypto.news reports that the analyzed sample supports keylogging, file management, and remote commands, and that screen capture and remote desktop functions are delivered as plugins that were not present in the sample. The two accounts therefore disagree on how much of the RAT's capability was present in the analyzed build. Both agree the RAT is designed for broad control of the infected machine.
Both payloads persist through registry entries and scheduled tasks. Crypto.news adds a Windows service and says the RAT's scheduled task runs every 30 minutes. Command-and-control domains cited in the reporting include server.vietnam852[.]com and www.swordaa[.]com. Crypto.news notes that the RAT's command infrastructure had already shut down before analysis, so the researchers examined the sample without a live server.
Scope and Attribution
Neither report confirms a victim count. FortiGuard has not attributed the campaign to a specific actor; the only pointer beyond technical indicators is Chinese-language traits found in the malware. Crypto.news, citing the same research, confirms that it does not identify the attackers either.
The campaign fits a broader pattern of cryptojacking and RAT deployment against exposed services. Crypto.news previously reported AhnLab's documentation of attacks on Rejetto HTTP File Server in 2024, including Monero miners and Gh0stRAT, and a Dutch NCSC advisory from August describing Monero miner installations through an internet-reachable macOS Screen Sharing port.
Defensive Steps
The mitigations in the reporting are conventional. Strong, unique credentials defeat a dictionary of this size. Keeping database ports off the public internet removes them from the scanner's target list. Keeping xp_cmdshell disabled, as Microsoft recommends, blocks the database-to-OS step that both reports identify as central.
Defenders can hunt for MicrosoftEdgeUpdate.exe consuming CPU on a database server, unexpected scheduled tasks and registry entries, a Windows service with an unexpected purpose, and outbound connections to mining pools. Crypto Briefing's assessment is that the RAT, not the miner, is the larger risk, because it can capture credentials and keystrokes and serve as a foothold into the wider network. Removing the miner alone may leave the RAT in place.
Why It Matters
For Traders
Cryptojacking campaigns like this consume host resources rather than moving market prices, so the direct effect on Monero trading is minimal.
For Investors
Repeated use of Monero miners in intrusion campaigns keeps the coin's association with illicit mining in the security literature, though no price impact is documented.
For Builders
Any service that exposes SQL Server or similar databases to the internet should enforce strong authentication, disable xp_cmdshell, and monitor for new scheduled tasks and outbound mining-pool traffic.
This article is for information only and is not financial advice. Read the full disclaimer.
