FortiGuard: Weak Passwords Let SQL Server Attacks Drop Monero
In this article4 sections
Attackers are breaking into internet-facing Microsoft SQL Server databases and installing two payloads: an XMRig-based Monero miner and a variant of the Gh0st remote access trojan, according to Crypto Briefing, citing research from FortiGuard Labs published on November 12, 2026. The campaign has been running since at least early October 2026.
The entry point was not a software flaw. The operators scanned for reachable database servers and then guessed logins from a list of more than 2,700 common passwords, Crypto Briefing reported. The research does not name the attackers and gives no confirmed victim count.
Key facts
- FortiGuard Labs disclosed the campaign on November 12, 2026; activity dates to at least early October 2026.
- Reconnaissance used Naabu, a scanner written in Go, and a .NET-based tool tried more than 2,700 passwords, according to Crypto Briefing.
- The miner runs as MicrosoftEdgeUpdate.exe and mines Monero via XMRig, connecting to pools that included nanopool and kryptex.
- The Gh0st RAT variant supports more than 30 commands, covering file management, keylogging, screen capture, remote desktop and theft of QQ credentials.
- crypto.news reported that FortiGuard Labs researcher Xiaopeng Zhang detailed the operation, and that the RAT’s scheduled task runs every 30 minutes.
How the intrusion unfolds
After a login succeeds, the attackers run malicious T-SQL commands that switch on xp_cmdshell, a SQL Server feature that passes instructions from the database to the underlying Windows operating system. Crypto Briefing described the effect bluntly: a server meant to store records becomes a launchpad for administrative commands.
Microsoft’s documentation, cited by crypto.news, says xp_cmdshell is disabled on new SQL Server installations and should generally stay off. The company recommends restricting the feature to highly privileged users and using a less-privileged proxy account when non-administrators need it.
The two outlets describe the second payload differently. Crypto Briefing calls it a Gh0st RAT variant supporting more than 30 commands. crypto.news reports the malware file is named winlogon.exe and that screen capture and remote desktop functions come through plugins that were absent from the analyzed sample. crypto.news also said it examined the RAT without connecting to a live command server because that infrastructure had already shut down; Crypto Briefing reported that several components had gone dark before researchers dug in, and named command-and-control domains including server.vietnam852[.]com and www.swordaa[.]com.
crypto.news adds that the miner’s configuration contained a wallet address and three mining pool addresses, and that the attacker installs a downloader after enabling xp_cmdshell to retrieve both payloads. Both reports agree the malware persists through registry changes, a Windows service or scheduled tasks, so a reboot alone will not remove it.
Why it matters
This is the same pattern seen before: in July 2024, AhnLab documented attackers using vulnerable Rejetto HTTP File Server installations to plant XMRig alongside XenoRAT and Gh0stRAT, with at least four attackers involved including the LemonDuck group. In August 2025, the Netherlands’ National Cyber Security Centre confirmed intrusions through exposed macOS Screen Sharing ports in which attackers gained root access and installed a miner every time. The recurring lesson is that exposed services plus weak authentication remain enough to hand over a server.
The miner is the visible symptom, but the trojan is the longer-term risk. A tool that logs keystrokes and steals credentials can turn one compromised database into a foothold across a network, and security teams that remove only the miner may leave the attacker in place.
What to watch
FortiGuard Labs has not attributed the campaign, so any update tying it to a known group would be the next signal. Administrators should treat a CPU-heavy MicrosoftEdgeUpdate.exe process on a database server, unexpected scheduled tasks, unusual registry entries and outbound mining-pool connections as hunt indicators.
Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.
Sources: Crypto Briefing, crypto.news
