Threat Actors Exploiting MS-SQL Servers to Deploy XiebroC2 Framework

AhnLab Security Intelligence Center (ASEC) researchers have uncovered a surge in attacks targeting improperly managed MS-SQL servers, culminating in the deployment of the open‑source XiebroC2 command-and-control framework. The malware offers information gathering, remote control, and defence‑evading capabilities similar to tools such as Cobalt Strike, making it attractive for threat actors seeking a low‑cost intrusion platform.

In a confirmed incident, attackers leveraged publicly exposed MS‑SQL server credentials, brute‑forced weak or default passwords, and then deployed payloads that included cryptocurrency miners as the primary malware. After gaining access, the attackers dropped JuicyPotato to escalate privileges, with the SQL Server service already operating under a low‑privilege account by default; JuicyPotato allows escalation to SYSTEM privileges.

Evidence shows a SQL Server service downloading XiebroC2 from a GitHub repository via PowerShell’s Invoke-WebRequest over HTTP, with the implant then establishing a persistent encrypted WebSocket session to a C2 server using a preconfigured AES key. The incident highlights the need for strong authentication, limiting public exposure, and robust network controls to defend database servers.