Active SQL Server attacks are using more than 2,700 passwords to break into internet-facing database systems. Once authenticated, the attackers abuse legitimate SQL Server functions to install a Monero miner and a Gh0st remote access trojan.
Fortinet’s FortiGuard Labs disclosed the campaign on 12 November 2026, after observing activity since at least early October 2026. The operation remains an in-the-wild threat, although the command-and-control server associated with the RAT was offline during Fortinet’s analysis.
SQL Server attacks target exposed port 1433
The campaign targets Microsoft SQL Server running on Windows and reachable from the public internet over TCP port 1433, the service’s default port. Fortinet did not associate the activity with a particular SQL Server version, vulnerability or security patch.
Instead, the SQL Server attacks depend on exposed services and SQL accounts protected by passwords that can be guessed. Common account names attempted by the attackers include sa and admin. The sa account is particularly valuable because it may hold extensive administrative privileges.
The infection chain begins with a Go binary named dllhost.exe. Its filename imitates a legitimate Windows component, while UPX packing makes the program’s contents less straightforward to inspect.
Inside dllhost.exe is version 2 of Naabu, an open-source port-scanning tool. The binary contacts hxxp://site.vietnam852[.]com:88/ip.php to receive ranges of IP addresses, then checks random addresses within those ranges for systems responding on TCP port 1433.
Responsive hosts are recorded as potential targets before the malware requests another range. This automated approach allows the operators to find large numbers of publicly accessible database servers rather than selecting individual organisations in advance.
Eight files support the automated break-in
The scanner downloads eight support files into the Windows temporary directory. Fortinet identified the following components:
- 2018.sql, a T-SQL script used after authentication succeeds
- dwm.exe, the tool responsible for attempting SQL logins
- user.txt and pass.txt, containing usernames and passwords
- go.bat, go.vbs and out.bat, which support execution
- sqlcmd.exe, used to interact with SQL Server
Some reporting refers to the brute-force executable as dwn.exe rather than dwm.exe. Both filenames should therefore be treated as suspicious when found alongside other artefacts from this campaign.
How 2,700 passwords lead to Windows commands
The brute-force component reads account names from user.txt and more than 2,700 candidate passwords from pass.txt. It can run as many as 500 concurrent threads, enabling rapid login attempts against identified SQL Server instances.
These SQL Server attacks do not exploit a newly disclosed software flaw. They succeed when one of the supplied username and password combinations is accepted, highlighting the risk created by weak or reused SQL credentials on an internet-accessible service.
After a successful login, the tool runs 2018.sql against the compromised database server. This script uses Transact-SQL, also known as T-SQL, to enable xp_cmdshell.
Xp_cmdshell allows SQL Server to execute commands through the Windows command shell. Microsoft disables it by default, but an attacker with sufficient SQL privileges can attempt to enable it. In this campaign, it becomes the bridge between database access and control of the underlying Windows host.
The script then issues operating system commands that retrieve and execute additional files. Payloads are placed in locations including C:\Users\Public\, where filenames such as Google.exe or payload.exe may make the activity appear less conspicuous during a casual review.
Edge-themed tasks provide persistence
The attackers create scheduled tasks designed to resemble Microsoft Edge update activity. Fortinet documented a task named MicrosoftEdgeUpdateTaskMachineUA followed by a GUID, configured to execute every 30 minutes.
In Fortinet’s example, the scheduled task referenced E:\dllhost.exe. This persistence mechanism allows the malicious program to restart regularly, including after interruption, while using a name that administrators may initially mistake for a legitimate browser updater.
Other observed activity included a downloader named Secs.exe and additional files retrieved for execution from temporary or public Windows directories. The scheduled task names, paths and recurrence intervals provide useful evidence when investigating suspected SQL Server attacks.
Miner and Gh0st RAT payloads explained
The first main payload is an XMRig-based cryptocurrency miner configured to generate Monero. It consumes the compromised server’s processing resources for the attacker’s benefit and is also named to resemble Microsoft Edge update software.
Mining can degrade database and application performance, increase electricity use and disrupt services. However, the second payload creates the more serious security risk because it gives the operators continued remote access to the Windows system.
This payload is a variant of Gh0st RAT named after a Windows process. Fortinet found support for more than 30 control commands, allowing an operator to perform actions including:
- Recording keystrokes entered on the infected system
- Browsing, uploading, downloading and managing files
- Opening a remote command shell
- Capturing the screen and using remote desktop functions
- Collecting system and user information
- Checking for dozens of installed security products
The combination of keylogging, file access and remote shell control means a compromised database server could be used for data theft or further movement through a network. The RAT’s command-and-control server was offline when Fortinet analysed it, which restricted live testing but does not remove the risk posed by infected hosts.
Campaign timeline and current exploitation status
Fortinet began observing the campaign in early October 2026. Its technical analysis and indicators of compromise were published on 12 November 2026, with other security publications independently confirming the same infection chain that day.
As of 13 November 2026, the activity is considered an active, real-world campaign rather than a proof of concept. No threat actor has been named, and the operation uses a mixture of commodity components, open-source scanning software and purpose-built brute-force and loader tools.
The affected population is not defined by a product version. Any Windows-based Microsoft SQL Server instance exposed to the internet on TCP port 1433 may be tested, with systems using guessable SQL credentials facing the clearest risk.
Actions to take against these SQL Server attacks
Organisations should first determine whether TCP port 1433 is publicly reachable. Where external connectivity is necessary, access should be limited to approved source addresses through firewalls, private connectivity or equivalent network controls.
Administrators should review SQL authentication logs for repeated failures followed by a successful login, particularly involving sa or admin. Passwords must be strong and unique, while Windows-only authentication should be considered where operationally suitable.
Xp_cmdshell should remain disabled unless there is a documented administrative requirement. Teams should also search for the observed filenames, unexpected files in temporary and public directories, and Edge-themed scheduled tasks running every 30 minutes.
Finding a miner should not be treated as the full extent of an incident. Because this campaign also deploys Gh0st RAT, affected servers should be isolated and investigated for credential theft, unauthorised file access and activity elsewhere on the network.
Originally reported by cybersecuritynews.com.
