A campaign has been breaking into internet-facing Microsoft SQL Server instances with weak passwords to install a Monero cryptominer and a Gh0st remote access trojan (RAT).
FortiGuard Labs, Fortinet's research team, uncovered the campaign in early October 2026 and rated it high severity, according to new research published on November 12. The report did not say how many servers were compromised or who was behind the campaign.
The initial Go payload contained the open-source Naabu port scanner. It retrieved an IP range from its server, scanned it for TCP port 1433, the default SQL Server port, and recorded the hosts that responded, before requesting another range and starting again.
Attackers Scan and Brute-Force SQL Servers
A brute-force tool then tried usernames including "sa" and "admin" against more than 2700 passwords on each host the scanner found.
After a successful login, the malware ran Transact-SQL (T-SQL) commands on the server. T-SQL is SQL Server's extension of the SQL database language, adding programming features to standard queries.
The commands enabled xp_cmdshell, which runs operating system commands, then downloaded or unpacked a loader. They also scheduled the loader to run daily and placed a copy in the Startup folder so it ran when the server booted.
The loader pulled additional malware from an FTP server and registered each compromised server with the attackers' backend. The data sent back included the public IP address, country, Windows edition, processor and memory details, Windows installation time, user name and host name.
Cryptominer and Gh0st RAT Hide on Servers
One payload was a Monero cryptominer based on XMRig that used the compromised server's processor. It was named to look like a Microsoft Edge update, as were two of the scheduled tasks the malware created, and reported to the attackers when mining began.
Read more on cryptomining: Cryptominer Abuses Linux PAM to Hide From SOC Analysts
The second payload was a Gh0st RAT variant named after a Windows system process. Its command-and-control (C2) server had shut down before Fortinet's analysis, so researchers examined its code without running it.
The RAT supported keylogging, data theft and over 30 control commands, with plugins providing screen capture and remote desktop. It could also clear event logs, check for 78 security products by process name and steal data from the QQ messaging app.
For persistence, it used a registry Run key, a Windows service and a scheduled task that ran every 30 minutes.
In effect, the search had no built-in end, continuing for as long as the attackers’ server kept handing out new address ranges.