Cryptominers Target SQL Servers With Weak Passwords

"The brute-force tool then tried usernames including "sa" and "admin" against more than 2700 passwords on each host the scanner found."

Naabu-powered scanning of TCP port 1433 and continuous address harvesting

FortiGuard Labs, Fortinet’s research team, uncovered a campaign in early October 2026 that used a Go payload embedding the open-source Naabu port scanner. The payload retrieved an IP range from the attackers' server, scanned that range for TCP port 1433 — the default Microsoft SQL Server port — recorded hosts that responded, then requested another range and repeated the process. Fortinet rated the campaign high severity in research published on November 12.

That scanning loop had no built-in end: it continued "for as long as the attackers’ server kept handing out new address ranges," according to the report. The initial probe focused explicitly on internet-facing SQL Server instances that answered on port 1433.

Brute-force access, T-SQL abuse, and persistence on compromised servers

After identifying responsive hosts, the campaign deployed a brute-force tool that tried usernames including "sa" and "admin" against more than 2700 passwords on each host the scanner found. When a login succeeded, the malware executed Transact-SQL (T-SQL) commands — SQL Server’s extended language — to change the server state and install a loader.

Specifically, the T-SQL commands enabled xp_cmdshell, a mechanism that runs operating-system commands from within SQL Server. The attacker then used that capability to download or unpack a loader, register scheduled tasks that ran daily, and place a copy of the loader in the Windows Startup folder so it executed on boot. This combination of scheduled tasks and startup persistence ensured the loader would resume after restarts and at regular intervals.

Loader behavior and backend registration details

The loader fetched additional components from an FTP server and registered each compromised host with the attackers' backend. The registration package sent a concise technical profile back to the operators: the public IP address, country, Windows edition, processor and memory details, Windows installation time, user name and host name. This telemetry gave the attackers a rapid inventory of newly enlisted servers and their capabilities.

Fortinet’s report did not disclose how many servers were compromised or identify who was behind the campaign; it confined its findings to the artifacts and behaviors observed during analysis.

Monero mining disguised as a Microsoft Edge update

One of the payloads the loader deployed was a Monero cryptominer based on XMRig. The miner used the compromised server’s CPU and was named to look like a Microsoft Edge update. Two of the scheduled tasks the malware created were likewise named to resemble Microsoft Edge update tasks, and the miner "reported to the attackers when mining began."

The naming choices and scheduled-task placement indicate an attempt to blend into expected system activity and to persistently consume processor cycles for illicit mining.

Gh0st RAT variant: capabilities, evasion checks, and persistence

The second payload was a Gh0st remote access trojan (RAT) variant that Fortinet found named after a Windows system process. By the time researchers examined the campaign, the RAT’s command-and-control (C2) server had already shut down, so FortiGuard Labs analyzed the malware’s code without executing it.

The Gh0st variant supported keylogging, data theft, and more than 30 control commands. Plugins gave it screen-capture and remote-desktop functions; it could also clear event logs, probe for 78 security products by process name, and steal data from the QQ messaging app. For persistence the RAT used multiple techniques: a registry Run key, a Windows service, and a scheduled task set to execute every 30 minutes.

What this means for technologists, enterprises, and security teams

• Technologists and security teams: watch for exposed SQL Server endpoints answering on TCP port 1433, look for evidence of xp_cmdshell activation, unexpected scheduled tasks or items dropped in Startup, and outbound FTP retrievals tied to unknown binaries. The campaign’s use of a high-volume brute-force list (more than 2700 passwords) underscores weak or reused credentials as the primary initial failure point described in the report.
• Enterprises and procurement leaders: the incident highlights a vector where internet-facing database services — even those running legitimate Microsoft SQL Server installations — can become footholds when credentials are weak and remote command execution is possible. The artifacts Fortinet describes (named Edge-update binaries and tasks, registry Run keys, services and half-hour scheduled tasks) are specific indicators for inventory and endpoint controls to monitor.
• Security operations and incident responders: given the RAT’s ability to check for dozens of security products and to clear event logs, defenders should assume post-compromise tampering is possible and prioritize forensic capture before remediation steps that would destroy volatile evidence.

The campaign illustrates a straightforward, high-volume approach: scan public address space for SQL Server instances, brute-force weak credentials, enable xp_cmdshell, and let a loader bring in a miner and a RAT that combine resource theft with long-term access. And because the search "had no built-in end," the campaign would continue so long as the attackers’ infrastructure supplied new address ranges — a blunt reminder that opportunistic abuse of weak passwords remains a persistent, practical threat.

Original Fortinet report: https://www.infosecurity-magazine.com/news/fortinet-sql-server-cryptominer/