Trending Topics
Trending
Weak passwords and SQL used in Gh0st RAT attack against Microsoft users
FortiGuard Labs has shared new research on a threat campaign first uncovered in October. The campaign has been using brute-force attempts against internet-facing Microsoft SQL Server logins, then running T-SQL commands to install a Monero crypto miner and Gh0st Remote Access Trojan malware.
“The malware scans IP ranges for exposed SQL Servers and attempts to log in using supplied credentials,” FortiGuard Labs said. Once it gains access, it remotely runs malicious T-SQL commands on the compromised server to download and launch additional malware.
Whether you pronounce it as sequel or spell it out as S-Q-L, I even heard one person say squirrel; it matters not: what does matter is taking it seriously when it comes to security. Yes, you heard that right; in 2026, SQL remains a very real threat vector. Just this week, Ivanti released a patch for a vulnerability that enables code execution by an unauthenticated attacker using SQL injection in endpoint manager. Last month, AI agent attacks targeted the US Department of Education, also using SQL injection.
Here comes the technical bit. The payload is a Go binary using the Naabu scanner that retrieves a target IP range from its command and control server, probes TCP port 1433 to identify reachable servers, and records each successful response.
An executable attempts to brute-force MSSQL logins using a list of users and passwords before the T-SQL commands in 2018.sql are run on each successfully compromised server.
What you need to know about the Gh0st RAT attack
You want a TL;DR? Of course you do, so here it is: Exposed SQL Server instances and weak credentials are bad, m’kay.
“This campaign illustrates the persistent challenge IT and security teams face: securing privileged access across complex, and often legacy, infrastructure,” said Shane Barney, Chief Information Security Officer at Keeper Security.
“While internet-facing databases are sometimes the unintended result of technical debt or misconfigurations, relying on static, standing credentials is what turns that exposure into a critical vulnerability.”
This means that the root of this particular threat will often sit with secrets management.
“Database credentials frequently remain static because they are hardcoded into legacy applications, embedded in automated scripts, or shared among administrators to maintain uptime,” Barney explained, continuing, “attackers know this and routinely scan default ports because these standing privileges yield massive operational leverage.”
“Organisations should remove direct internet access to SQL Server, restrict connections to approved systems and enforce strong, unique credentials” said Jason Soroko, Senior Fellow at Sectigo.
Security teams should also investigate SQL Server spawning command shells, new scheduled tasks and failed logins followed by success. “A compromised server needs containment, a search for persistence and a review of exposed credentials before it returns to service,” Soroko warned.
Related articles
About The Author
