Hackers Hijack Microsoft SQL Servers to Deploy Gh0st RAT and Monero Mining Programs

FortiGuard Labs has disclosed an attack activity targeting Microsoft SQL Server databases exposed on the internet. The attackers exploited weak passwords and misconfigurations to gain access to the servers through brute force, enabling the xp_cmdshell feature and implanting two types of malicious payloads: a Monero mining program disguised as MicrosoftEdgeUpdate.exe, and a variant of Gh0st RAT that supports functionalities such as keylogging and screen capturing. Both payloads achieve persistence by modifying the registry and scheduled tasks. This activity has been active since at least early October 2026, with the number of victims yet to be confirmed, and the attacks have not been attributed to specific actors.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.