Attackers use weak SQL Server passwords to deploy cryptominer and Gh0st RAT

Researchers at Fortinet’s FortiGuard Labs found a campaign from early October 2026 where intruders used weak or default passwords to break into internet-facing Microsoft SQL Server instances and install a Monero cryptominer plus the Gh0st remote access trojan.

The company assessed the intrusion at high severity and released its research on Nov. 12, 2026. It said the attack depended on cracked or default database credentials instead of a new software flaw, and that no zero-day was involved.

The opening payload was a Go-based program called dllhost.exe. It launched the open-source Naabu scanner to hunt for systems with TCP port 1433 open, Microsoft SQL Server’s default port. The scanner pulled IP address blocks from an attacker-controlled server, widened them into /16 network ranges, turned those ranges into CIDR blocks, which group IP address ranges so the scanner can probe them, and kept probing randomly chosen addresses without a built-in stop, logging each host that answered.

On hosts with responsive database ports, a brute-force piece tried common admin names such as “sa” and “admin” against a password list of more than 2,700 entries. One report named the executable dwn.exe, while another called it dwm.exe.

Once the login worked, the malicious code ran Transact-SQL instructions from a file named 2018.sql to enable xp_cmdshell. T-SQL adds programming features to standard queries, extending the SQL database language that SQL Server uses. xp_cmdshell allows database administrators to execute Windows command shell operations from within SQL Server. They then leveraged xp_cmdshell to pull down or unpack executables into the server’s C:\Users\Public directory and execute them on the Windows host.

A loader pulled additional malware from an attacker-controlled FTP server and registered every compromised server with a backend the attackers controlled. One downloader executable carried the name Secs.exe, and the malicious script placed files in the Windows Public folder. The attackers also exfiltrated a profile of each victim, sending back the public IP address and country, the Windows edition, processor and memory details, installation time, and the username and host name of each machine.

One payload, MicrosoftEdgeUpdate.exe, was an XMRig-based Monero cryptominer that disguised itself as a browser update.

Fortinet identified winlogon.exe as a Gh0st RAT variant that borrowed the name of a Windows system process. Its capabilities included keylogging, data theft, file management, remote shell execution, process management, and more than 30 control commands, while plugins added screen capture and remote desktop access. The trojan could also erase event logs, scan running processes for 78 security products, and extract data from the QQ messaging app.

To maintain access after restarts, the RAT created a registry Run key, registered itself as a system service, and started a recurring half-hour task. The malware family also scheduled the loader to run each day, dropped a copy in the Startup folder for boot-time execution, and created additional scheduled tasks. The downloader set up a separate daily task to run at 1 AM, apart from the initial payload’s half-hour recurring task.

Fortinet conducted its analysis after the RAT’s command-and-control server had already shut down, which forced researchers to study the code statically instead of executing it. The report did not state the number of compromised servers or identify who was behind the campaign, Fortinet said.

Keeper Security chief information security officer Shane Barney said static, standing credentials turn database exposure into a critical risk. He said attackers who crack administrative passwords can deploy malware immediately, with no complex exploit required. He added that mining activity could act as a smokescreen for establishing lasting persistence with remote access tools. “When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit,” Barney said.

Barney said organizations should stop using standing administrator credentials, moving instead to zero standing privilege, automatically rotated credentials, and time-limited access. He said that in a mature zero-trust environment, administrators do not have to know the actual database password. He said administrators can submit queries through a secure brokered link that never exposes administrative credentials when zero-trust controls and continuous session monitoring work together.

Sectigo senior fellow Jason Soroko urged firms to block direct internet exposure for SQL Server and permit only approved connections. He also urged strong unique credentials, keeping xp_cmdshell off unless needed, and watching for attempts to enable it. “The miner consumes resources, while the remote access trojan can steal information and maintain access,” Soroko said.

Soroko said removing the miner would not fix the full breach because the trojan can still steal data and maintain access. He said the database account and the SQL Server service account hold privileges central to the risk.

Soroko said defenders should watch for SQL Server spawning command shells, newly created scheduled tasks, and failed logins immediately followed by successful ones. He said an affected server should be contained, examined for persistence mechanisms, and have its exposed credentials reviewed before it goes back into service.

Microsoft did not respond to a request for comment on the activity. FortiGuard said its IPS, Web Filtering, and Antivirus services detect the campaign, and the company released indicators of compromise to help other organizations spot infections. Xiaopeng Zhang, a FortiGuard researcher, disclosed the campaign to CSO Online ahead of its Thursday publication.