[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYZOh5iAZgoDMrEb7hO6auB1hKQtlUMKBru8OGkGPjFM":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"bf1aec8d-9394-4877-8ed2-0086c5b7f5df","Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT","hackers-abuse-microsoft-sql-servers-to-deploy-monero-miner-and-gh0st-rat-20a0e5","Hackers target weak Microsoft SQL Server passwords to install a Monero miner and Gh0st RAT, using database features…","Attackers are targeting internet-exposed Microsoft SQL Server installations with password-guessing attacks, using database features to install a Monero miner and Gh0st RAT on underlying Windows servers. Fortinet identified the campaign in early October 2026, noting it relies on weak credentials rather than software vulnerabilities. The campaign combines cryptocurrency mining with remote access capabilities, allowing attackers to monitor activity, access files, and execute commands.","Hackers exploit weak SQL server passwords to deploy Monero miners and Gh0st RAT.","https:\u002F\u002Fhackread.com\u002Fhackers-abuse-microsoft-sql-servers-monero-miner-gh0st-rat\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fhackers-abuse-microsoft-sql-servers-monero-miner-gh0st-rat.jpg","2026-11-12T16:30:49+00:00","2026-11-12T17:00:27.854478+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft SQL Server","product",{"name":21,"type":22},"Fortinet","vendor",{"name":24,"type":25},"Transact-SQL","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,48],{"type":30,"value":46,"context":47},"Gh0st RAT","Remote access trojan deployed by attackers.",{"type":30,"value":49,"context":50},"Monero miner","Cryptocurrency miner deployed by attackers.",[21,18],{"controls":53,"vendors":137},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,66,74],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":55,"product_name":63,"url":64,"description":65},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":83,"name":84,"problem":85,"products":86},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,121,129],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":117,"product_name":118,"url":119,"description":120},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[138,143],{"slug":139,"name":21,"logo_path":140,"roles":141},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[142],"reported_by",{"slug":88,"name":89,"logo_path":90,"roles":144},[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"weak-sql-server-credentials-open-door-to-miners-and-rat","Weak SQL Server Credentials Open Door to Miners and RAT","Attackers successfully compromised internet-exposed Microsoft SQL Server instances by simply guessing weak passwords — no software vulnerability was needed. Once inside, they abused built-in database features to drop a Monero cryptocurrency miner and Gh0st RAT, gaining persistent remote access to the underlying Windows host. This attack illustrates how a single weak credential on an internet-facing service can hand attackers full control of a system. Exposing database servers directly to the internet with default or trivial passwords remains one of the most preventable yet persistently exploited misconfigurations in enterprise environments.",[151,152,153,154,155],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(i)","MITRE ATT&CK T1110: Brute Force",{"NIS2 Article 21(2)(i)":157,"MITRE ATT&CK T1110: Brute Force":158,"CIS Control 6: Access Control Management":159,"NIST SP 800-53 IA-5: Authenticator Management":160,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":161},"This point covers access control and asset management, requiring organisations to enforce appropriate authentication controls on critical systems like internet-facing database servers.","The attackers used password-guessing (a brute-force technique) against SQL Server authentication as their sole method of initial access, making this technique directly applicable to the incident.","This control requires enforcing strong credentials and least-privilege access; had SQL Server accounts been subject to these requirements, password-guessing attacks would have been far less likely to succeed.","IA-5 mandates minimum password complexity and prohibits easily guessable credentials, directly addressing the weak SQL Server passwords that allowed attackers to gain initial access.","This control requires hardening default configurations — including disabling dangerous features like xp_cmdshell and renaming default accounts — which would have removed the database-level capabilities attackers used to execute OS commands."]