Fortinet Finds SQL Servers Targeted by Cryptominer and Gh0st RAT

Fortinet’s FortiGuard Labs reported a campaign targeting internet-facing Microsoft SQL Server instances that are protected by weak passwords. The operation began with a Go payload carrying the open-source Naabu port scanner, which retrieved an IP range, scanned for TCP port 1433 (the default SQL Server port), and logged responding hosts for subsequent rounds. A brute-force tool then attempted usernames such as “sa” and “admin” against more than 2,700 passwords on each discovered host.

Upon a successful login, the attackers executed Transact-SQL commands to enable xp_cmdshell, downloaded or unpacked a loader, and scheduled it to run daily. They also placed a copy in the Startup folder to ensure persistence when the server rebooted.

The loader then retrieved additional malware from an FTP server and registered each compromised server with the attacker's backend, sending back details including the public IP, country, Windows edition, processor and memory information, Windows installation time, user name and host name.

Two payloads were observed on the compromised servers. One was a Monero cryptominer based on XMRig, masquerading as a Microsoft Edge update, with two scheduled tasks also named to resemble legitimate updates. The other was a Gh0st RAT variant, whose C2 server had shut down before Fortinet’s analysis; researchers studied its code without executing it. The Gh0st RAT variant supported keylogging, data theft, and over 30 control commands, with plugins for screen capture and remote desktop.

Persistence relied on a registry Run key, a Windows service, and a scheduled task running every 30 minutes, enabling the attackers to continue scanning for new address ranges as long as the central server supplied them.