FortiGuard Labs has uncovered a campaign that breaks into internet-facing Microsoft SQL Servers to install Monero mining software and remote-access malware capable of stealing data and controlling infected machines.
Summary
- Attackers use weak database passwords to install a Monero miner and a Gh0st RAT variant.
- The mining program poses as a Microsoft Edge updater while using the server’s processing power.
- Registry changes, Windows services, and scheduled tasks help the malware maintain access to compromised systems.
FortiGuard Labs detailed the operation in a Nov. 12 report by researcher Xiaopeng Zhang, following its discovery of the activity in early October 2026. The publication does not identify the attackers or give a confirmed victim count.
Weak SQL Server passwords let attackers install malware
According to the research, the attack tools search for exposed databases and attempt to log in using predefined credentials. The password list contains more than 2,700 entries, paired with usernames such as “sa” and “admin.”
After gaining access, the attackers run database commands that enable xp_cmdshell and install a downloader. The downloader retrieves the Monero miner and Gh0st RAT from an attacker-controlled server.
Microsoft’s documentation says xp_cmdshell is disabled on new SQL Server installations and should generally remain switched off. Some older applications still require it, but the company recommends enabling it only while a necessary task runs.
The feature opens a Windows command shell from inside SQL Server. Microsoft explains that commands run by a database administrator through this mechanism inherit the security permissions of the SQL Server service account. Its guidance recommends restricting access to highly privileged users and using a less-privileged proxy account when non-administrators need the feature.
Microsoft notes that a non-administrator needs a configured proxy credential to use xp_cmdshell. Without that credential, the operation fails. The company warns that enabling or using the feature can trigger security audit tools.
Monero miner hides behind an Edge update name
The mining payload, MicrosoftEdgeUpdate.exe, uses the compromised machine’s CPU to mine Monero through XMRig. Its configuration contains a wallet address and three mining pool addresses, according to Zhang’s analysis.
A second payload, winlogon.exe, is a Gh0st RAT variant with keylogging, file management, and remote command capabilities. Screen capture and remote desktop functions are supplied through plugins; they were not present in the analyzed sample.
Persistence mechanisms described in the report include registry entries, a Windows service, and scheduled tasks. The RAT’s scheduled task runs every 30 minutes.
The researchers examined the RAT without connecting it to a live command server because that infrastructure had already shut down before analysis.
Earlier server attacks paired miners with remote-access tools
As crypto.news previously reported, attackers used vulnerable file-sharing servers to distribute Monero miners and remote-access malware in July 2024. AhnLab’s investigation documented attacks against Rejetto HTTP File Server, including installations of XMRig, XenoRAT and Gh0stRAT.
AhnLab identified at least four attackers deploying mining software through the exposed service, including the LemonDuck group. Its researchers observed intruders collecting system information, creating backdoor accounts and, in many cases, terminating the file server after establishing access to prevent other attackers from using it.
More recently, Apple patched a macOS flaw after attackers exploited Screen Sharing to install Monero miners. In an Aug. 12 advisory, the Netherlands’ National Cyber Security Centre confirmed intrusions on multiple systems whose Screen Sharing port was reachable from the internet.
The agency said attackers obtained root access and installed a miner in every reported case. Its advisory described an authentication weakness that allowed access without valid credentials, with fixes available for macOS Sequoia, Sonoma and Tahoe.
CrowdStrike recruitment scam delivered the same mining software
US cybersecurity company CrowdStrike faced a separate impersonation campaign involving fake recruitment offers in January 2025. The company said emails posing as its recruiters directed job seekers to download an application presented as an employee management tool.
CrowdStrike identified the campaign on Jan. 7, 2025. Its analysis found that the download page offered Windows and macOS options, although both delivered a Windows executable written in Rust that fetched XMRig.
Before proceeding, the malicious application checked for debugging software, counted active processes and verified that the CPU had at least two cores. After passing those checks, it displayed a fake error message and continued downloading the miner. CrowdStrike said it never requires candidates to download software as part of its recruitment process.
