A hacking campaign underway since early October 2026 has been targeting internet-facing Microsoft SQL Servers by brute-forcing logins using a list of more than 2,700 passwords. Once access is gained, attackers install both a cryptocurrency miner and a remote access trojan (RAT), leveraging the server as both a foothold and a resource.
How the Attack Chain Works
The initial intrusion begins with a file named dllhost.exe, built in Go and packed with UPX to obscure its origin. It masquerades as a legitimate Windows process while executing a port-scanning tool (Naabu) to identify servers with open TCP port 1433—the default SQL Server port. Potential targets are saved to a list called Result.txt, after which the malware requests new IP ranges from its command server. Loaded alongside this are eight auxiliary files, including go.vbs, go.bat, and a key brute-force tool labeled dwm.exe.
The dwm.exe component—actually a .NET application—tries to break into compromised SQL Servers by combining usernames such as “sa” and “admin” with over 2,700 commonly used passwords. The process runs concurrently over up to 500 threads. Successful logins trigger execution of a malicious SQL script, 2018.sql, which enables the xp_cmdshell extension. This allows the malware to issue Windows commands from within the SQL environment.
From there, two distinct payloads are deployed. One runs via a file disguised as a browser update task—named MicrosoftEdgeUpdate.exe—which in reality is a Monero miner packed with Themida and a custom LZSS packer. The other, winlogon.exe, is a variant of Gh0st RAT. Both are made persistent via scheduled tasks and registry entries. Gh0st RAT grants attackers full control: remote shell, keystroke logging, file exfiltration (including data from apps like QQ), and screen capture.
Impacts, Indicators, and Defense
Victims experience reduced server performance, elevated power use, and unauthorized access. To cover their tracks, the attackers employ evasion techniques—checking for nearly 80 security tool process names and using misleading file and task names. Monitoring tools were able to unpack and analyze the malware, even though command-and-control servers were offline during testing.
Key indicators of compromise include domains like site.vietnam852[.]com and ftp.vietnam852[.]com, along with filenames such as dllhost.exe, 2018.sql, and MicrosoftEdgeUpdate.exe. Numerous URLs and SHA-256 hashes also tie back to various stages of malware delivery and control. Targeted SQL Servers are instructed to download payloads into public folders, set up mimic tasks, and schedule persistence mechanisms.
Defensive steps: do not expose SQL Server port 1433 directly to the internet. Place such servers behind a firewall or VPN. Use strong, unique passwords; disable or rename the “sa” account; and limit password attempts. Disable xp_cmdshell unless there’s no other option. Watch for unusual scheduled tasks that mimic browser updates, odd executables in public system folders, or sudden spikes in CPU usage.
This tactic isn’t entirely new—one of the tools used, Gh0st RAT, has targeted MS-SQL servers before. Still, the scale and sophistication keep growing. SQL servers continue to be high-value targets, and flaws in basic security hygiene are being leveraged aggressively.
What this means: This breach campaign underlines a long-standing reality in cybersecurity: attackers often don’t need zero-day exploits when weak configurations, poor password management, and exposed ports provide easier access. For organizations, especially those managing high-value infrastructure, the uphill battle is not just reacting to threats but maintaining solid fundamentals—proper network segmentation, minimal exposure, and robust credential policies. Stay alert; today’s standard defense measures may be tomorrow’s exploitable weakness.
