Exposed SQL Servers targeted by Monero miner and Gh0st RAT

In a report published Nov. 12, researcher Xiaopeng Zhang said the activity was discovered in early October 2026. FortiGuard Labs did not name the attackers or provide a confirmed victim count.

The attackers scan for exposed databases and try predefined credentials paired with usernames including “sa” and “admin.” Once inside, they run database commands to enable xp_cmdshell, then install a downloader that fetches both payloads from an attacker-controlled server.

Microsoft says xp_cmdshell is disabled by default on new SQL Server installations and should generally remain off. The feature opens a Windows command shell through SQL Server; commands inherit the permissions of the service account. Microsoft advises limiting access to highly privileged users and using a less-privileged proxy account when needed. Without a configured proxy credential, non-administrators cannot use the feature.

The miner, named MicrosoftEdgeUpdate.exe, uses the server’s CPU to run XMRig and mine Monero. Zhang’s analysis found a wallet address and three mining pool addresses in its configuration. The second payload, winlogon.exe, is a Gh0st RAT variant with keylogging, file-management and remote-command functions. Screen capture and remote desktop capabilities are delivered through plugins, but were absent from the sample examined.

Registry entries, a Windows service and scheduled tasks help the malware persist. One task runs the RAT every 30 minutes. Researchers did not connect the RAT to a live command server because the infrastructure had shut down before analysis.

Other reports have documented miners paired with remote-access tools. In July 2024, AhnLab described attacks using exposed Rejetto HTTP File Server installations to deploy XMRig, XenoRAT and Gh0stRAT; it identified at least four attackers, including LemonDuck. In a separate case, the Netherlands’ National Cyber Security Centre said in an Aug. 12 advisory that attackers exploited internet-reachable macOS Screen Sharing to gain root access and install miners. CrowdStrike also reported in January 2025 that fake recruitment offers led victims to a Windows executable that downloaded XMRig.