$MSFTB Microsoft SQL Server is under attack again
Hackers are brute-forcing publicly exposed SQL Server instances using weak passwords. After enabling xp_cmdshell, they install a Monero miner and the Gh0st RAT remote-access trojan.
The activity began in early October and relies mainly on weak passwords and misconfigurations—not sophisticated vulnerabilities. Once a database server is compromised, attackers can mine cryptocurrency and steal data, posing a significant risk.
Hackers are brute-forcing publicly exposed SQL Server instances using weak passwords. After enabling xp_cmdshell, they install a Monero miner and the Gh0st RAT remote-access trojan.
The activity began in early October and relies mainly on weak passwords and misconfigurations—not sophisticated vulnerabilities. Once a database server is compromised, attackers can mine cryptocurrency and steal data, posing a significant risk.
