Between September 25 and 29, 2026, attackers hijacked a Microsoft SQL Server in a Microsoft Viva Aerobus environment to execute commands and siphon off data without needing a standard malware command-and-control server. Security researchers tracking the breach discovered that the SQL Server was repurposed into both a control channel and an exfiltration pipeline, while cloning code and credential material were exposed to the public from an attacker-operated server.
How the Attack Unfolded
The attackers leveraged the xp_cmdshell feature in SQL Server, which, when enabled, lets the database execute operating system commands. Through database sessions, they ran encoded PowerShell scripts and commands that reach beyond the SQL database layer into the Windows system beneath. What makes this case notable is the way they used SQL query responses themselves to send stolen material—large files were cut into fragments, transformed into Base64 text, and then transmitted via SQL query outputs.
The security team observed that the exposed server wasn’t just collecting data; it was also serving tools and artifacts openly, meaning anyone monitoring could grab scripts, stolen credentials, or other exfiltrated files from its publicly accessible directories. The access was continuous, with HTTP logs showing the first retrieval of malware payloads on September 25 and multiple other hosts pulling material from the exposed server later that same day.
What Attackers Took—and What They Prepared For
The exposed toolkit included tools commonly used for credential dumping—like Mimikatz—alongside scripts for extracting browser credentials, saved Windows passwords protected by DPAPI, email, OAuth, payment configuration files, and more. The evidence points to attempts to misuse harvested credentials to penetrate other systems via SQL Server logins or by accessing SMB-admin shares. However, there’s no confirmed proof yet that those secondary compromises succeeded.
Although the breach originated somewhere in the Viva Aerobus environment, the exact entry point—whether a vulnerable SQL login, a software flaw, or credential reuse—remains unknown. No specific malware strain has been tied to the attack; instead, what’s visible is a suite of disparate tools tied together in the staging server infrastructure that was left wide open online.
Indicators of compromise (IoCs) from the incident include the staging server IP address 151.243.232.123, several SHA256 hashes for tools like exfil.py and upload.py, file names such as chrome_dump.ps1 and sqlspray.ps1, and directories named loot/ and loot2/ holding the exposed data.
Risk Mitigation & Detection
Responding organizations are urged to look for unusual SQL Server behavior—especially unexpected use of xp_cmdshell, encoded PowerShell commands in SQL sessions, and file read/write operations under SQL service accounts. Administrators should also audit preserved connection histories or saved credentials and trace any that match the IoCs released. Credentials seen on the exposed server should be treated as compromised.
At this stage, though, there’s no evidence confirming exposure of sensitive passenger, payment, or business data. The compromise seems to have technical scale and depth—but not yet a proven data breach of core customer assets.
What makes this attack especially concerning is how it blends multiple threat vectors: database abuse, credential harvesting, and open staging infrastructure that outsiders could access as easily as attackers. It’s a warning that once access is obtained—even if limited to SQL—it’s possible to move powerfully laterally and expose internal secrets without conventional C2 channels. Organizations reliant on SQL Servers should enforce tight controls on sensitive features like xp_cmdshell, monitor PowerShell executions carefully, and treat any exposed credentials or secrets as immediately compromised. Continuous monitoring and historic log review are no longer optional—a single misconfiguration can lead to systemic exposure. This isn’t just a vulnerability—it’s a playbook that’s now on full display.
