"Most of us in IT spend our energy trying to keep attackers out." — Huntress
SQL injection on a web page gave access to a Microsoft SQL Server host
In June, Huntress' security team investigated an incident that began not with a direct database exploit but with an unvalidated input field on a webpage hosted on the same server as Microsoft SQL Server. Analysts traced suspicious activity to a Microsoft SQL Server process and, on deeper inspection, found a classic SQL injection vulnerability in a web page that allowed the attacker to reach the underlying Windows machine. The post notes that SQL injection "remains one of the most common (and most preventable) web application vulnerabilities."
Reconnaissance and persistence: RDP, administrative accounts, and disabling Defender
Once inside, the attacker performed basic reconnaissance by running a built-in Windows command to list running services, then exfiltrated the results to a server they controlled. From there the intruder made a sequence of environment changes designed to persist and preserve high privileges: they enabled Remote Desktop access, created a new user account and added it to the local Administrators group, and logged in over Remote Desktop using that account. The attacker also disabled Windows Defender but left other security monitoring tools "like EDR" untouched — an outcome Huntress described as unusual, and one that likely reflects either a failure to notice EDR or a lack of means to disable it.
BadIIS: converting the victim's IIS site into a search‑ and ad‑fraud platform
The intruder installed add-ons for Internet Information Services (IIS) linked to the BadIIS malware family. According to Huntress, BadIIS is typically used to hijack legitimate website traffic for search‑engine fraud: redirecting visitors, injecting hidden links, or serving different content than the site owner intended. In short, the attacker turned the compromised web server into a tool for manipulating search rankings and ad traffic without the website owner's knowledge.
Cryptomining, file hiding, and service‑based persistence
Beyond traffic hijacking, the attacker installed a cryptocurrency mining program to monetize the compromised host. To conceal that activity they changed file attributes (marking files hidden, system, and read‑only), set the miner to run as a Windows service using a legitimate, freely available administrative tool, and installed an additional tool intended to help the malware avoid detection. Huntress also observed multiple PowerShell scripts and batch files downloaded from external servers, and PowerShell used in a mode that produced no visible windows, no security prompts, and no restrictions from Windows' script execution policies.
What this means for security teams, web developers, and IT managers
- Security teams: Huntress' analysts underline the need to investigate root cause, not only remove malware or accounts. If defenders stop at surface‑level cleanup and do not remediate the SQL injection entry point, the attacker "could have simply walked back in through the same open door."
- Web developers and application owners: The incident is a reminder that unvalidated input on a single webpage can grant full machine access. The post recommends shrinking the attack surface, removing unnecessary services and applications, and keeping all web applications patched and included in monitoring coverage.
- IT managers and infrastructure owners: Huntress urges inventories of every physical and virtual system and every application and version across the environment, plus stricter access controls (including widespread multi‑factor authentication) so that newly created accounts cannot so easily gain administrator status and survive reboots or basic cleanup.
Huntress' central lesson is direct: "finding and fixing the entry point matters as much as cleaning up the mess left behind." In this June case, the entry point was an unvalidated web input; cleaning without remediation would likely have invited a repeat intrusion, potentially with more evasive or destructive tactics. The incident shows how an attacker can reshape a victim environment to their advantage by combining straightforward reconnaissance, persistent administrative access, web‑server manipulation, stealthy mining, and scripted delivery of tools.
Read the original Huntress analysis: https://www.bleepingcomputer.com/news/security/after-the-break-in-what-attackers-do-once-theyre-already-inside/
