Hackers hijack Microsoft SQL Servers to deploy Gh0st RAT and Monero miners

FortiGuard Labs disclosed the operation on November 12, 2026, revealing how attackers exploit weak credentials on internet-facing Microsoft SQL Server databases. The campaign has been active since at least early October 2026, with public reporting following on November 12-13, 2026.

Attack methodology

The attack begins with reconnaissance using Naabu, a Go-based scanner, to identify accessible SQL Server instances. Attackers then employ a .NET tool to brute-force more than 2,700 common passwords. Once inside, they execute malicious T-SQL commands to enable xp_cmdshell, allowing database commands to control the operating system.

FortiGuard Labs emphasized that the campaign primarily exploits weak credentials and misconfigurations rather than sophisticated vulnerabilities.

Dual payloads

Upon gaining access, attackers deploy two payloads: a Monero miner using XMRig and a Gh0st RAT variant. The miner runs under the deceptive filename MicrosoftEdgeUpdate.exe and connects to mining pools including nanopool and kryptex.

The Gh0st RAT supports over 30 commands for file management, keylogging, screen capture, remote desktop access, and credential theft from QQ messaging platform. Both payloads establish persistence through registry modifications and scheduled tasks.

Infrastructure and risks

The command-and-control infrastructure used domains including server.vietnam852[.]com and www.swordaa[.]com. By the time researchers investigated, several components had already gone offline. While no victim count has been confirmed, Chinese-language traits in the malware suggest possible attribution, though FortiGuard Labs hasn't linked the campaign to any specific actor.

The greater risk isn't the miner but the RAT, which can transform one compromised database into a network-wide foothold. Security teams that only remove the miner without hunting for the trojan may leave attackers undetected.