Attackers compromised Microsoft SQL Server instances exposed to the internet by brute-forcing weak passwords with more than 2,700 common credentials. According to FortiGuard Labs, the campaign, active since early October 2026, also uses the xp_cmdshell feature to execute commands on the underlying operating system. The attackers deploy a Monero miner based on XMRig, along with a variant of Gh0st RAT capable of executing more than 30 commands, including file management, screen capture and credential theft. Both payloads establish persistence through registry modifications and scheduled tasks, while no victim count or responsible threat actor has been confirmed.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
