Attackers target Microsoft SQL servers with Monero miners and remote access malware
FortiGuard Labs has identified an active campaign targeting Microsoft SQL servers exposed to the Internet, deploying Monero cryptocurrency mining software alongside remote access malware designed to steal data and give attackers full control over compromised machines.
Detailed in a Nov. 12 report, the operation involves Gh0st RAT, a well-known remote access tool used in combination with Monero mining payloads. The attack vector relies on publicly accessible, exposed SQL Server instances, which are compromised to run the malicious software without requiring any further user interaction.
The dual-payload approach is notable: the mining software generates revenue for the attackers, while Gh0st RAT enables persistent access, data exfiltration, and ongoing system control. Organizations running Internet-facing SQL Server deployments are advised to audit their exposure and access controls.
#Microsoft #mineriacripto #Monero #attack #crypto $MSFT $XMR
FortiGuard Labs has identified an active campaign targeting Microsoft SQL servers exposed to the Internet, deploying Monero cryptocurrency mining software alongside remote access malware designed to steal data and give attackers full control over compromised machines.
Detailed in a Nov. 12 report, the operation involves Gh0st RAT, a well-known remote access tool used in combination with Monero mining payloads. The attack vector relies on publicly accessible, exposed SQL Server instances, which are compromised to run the malicious software without requiring any further user interaction.
The dual-payload approach is notable: the mining software generates revenue for the attackers, while Gh0st RAT enables persistent access, data exfiltration, and ongoing system control. Organizations running Internet-facing SQL Server deployments are advised to audit their exposure and access controls.
#Microsoft #mineriacripto #Monero #attack #crypto $MSFT $XMR
