Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware
Hackers exploit weak passwords to compromise Microsoft SQL Servers, deploying malware for crypto mining and remote
A new campaign is targeting internet-facing Microsoft SQL Server systems by attempting over 2,700 passwords to gain access. Once compromised, attackers deploy a cryptocurrency miner and a remote access trojan (RAT). The campaign, active since at least October 2026, abuses T-SQL to execute commands and download further malicious payloads, including a Monero miner and a Gh0st RAT variant.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers successfully brute-forced internet-facing Microsoft SQL Server instances using a dictionary of just 2,700 common passwords, highlighting that many organizations are still running database services with weak or default credentials directly exposed to the internet. Once inside, adversaries leveraged T-SQL — a legitimate database feature — to execute system commands, download a Monero cryptocurrency miner, and install the Gh0st RAT remote access trojan. This matters because a compromised database server provides attackers with both a persistent foothold and potential access to sensitive data stored within. The attack is entirely preventable: strong, unique passwords combined with network-level restrictions on database exposure would have stopped it before it started.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.