Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT
Hackers exploit weak SQL server passwords to deploy Monero miners and Gh0st RAT.
Attackers are targeting internet-exposed Microsoft SQL Server installations with password-guessing attacks, using database features to install a Monero miner and Gh0st RAT on underlying Windows servers. Fortinet identified the campaign in early October 2026, noting it relies on weak credentials rather than software vulnerabilities. The campaign combines cryptocurrency mining with remote access capabilities, allowing attackers to monitor activity, access files, and execute commands.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Fortinet?
Get an email when a new story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers successfully compromised internet-exposed Microsoft SQL Server instances by simply guessing weak passwords — no software vulnerability was needed. Once inside, they abused built-in database features to drop a Monero cryptocurrency miner and Gh0st RAT, gaining persistent remote access to the underlying Windows host. This attack illustrates how a single weak credential on an internet-facing service can hand attackers full control of a system. Exposing database servers directly to the internet with default or trivial passwords remains one of the most preventable yet persistently exploited misconfigurations in enterprise environments.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Gh0st RAT
- malware — Monero miner