[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnvn5lfAVREan6ddZFDx4wY5tN7SO7LVbEHc1ZrDYzjo":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"46c38cc8-2142-45d7-bb16-1a90d2787a44","Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware","hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91","A new campaign is guessing its way into internet-facing Microsoft SQL Server systems. The attackers use a list of more than 2,700 passwords and then install a cryptocurrency miner and a remote access trojan (RAT) on the hacked machines. The campaign has been running since at least early October 2026. Database servers hold valuable data, […] The post Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware appeared first on Cyber Security News.","A new campaign is targeting internet-facing Microsoft SQL Server systems by attempting over 2,700 passwords to gain access. Once compromised, attackers deploy a cryptocurrency miner and a remote access trojan (RAT). The campaign, active since at least October 2026, abuses T-SQL to execute commands and download further malicious payloads, including a Monero miner and a Gh0st RAT variant.","Hackers exploit weak passwords to compromise Microsoft SQL Servers, deploying malware for crypto mining and remote","https:\u002F\u002Fcybersecuritynews.com\u002Fbreak-into-microsoft-sql-servers\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-2700-Passwords-to-Break-Into-Microsoft-SQL-Servers-and-Deploy-Remote-Access-Malware.webp","2026-11-13T14:54:56+00:00","2026-11-13T15:01:25.768947+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"Microsoft SQL Server","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"T-SQL","technology",{"name":27,"type":25},"Naabu",{"name":29,"type":25},"Gh0st RAT",{"name":31,"type":25},"Monero miner","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":84,"name":85,"problem":86,"products":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":113,"name":114,"problem":115,"products":116},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[142,148],{"slug":143,"name":144,"logo_path":145,"roles":146},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[147],"reported_by",{"slug":149,"name":21,"logo_path":150,"roles":151},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","Attackers successfully brute-forced internet-facing Microsoft SQL Server instances using a dictionary of just 2,700 common passwords, highlighting that many organizations are still running database services with weak or default credentials directly exposed to the internet. Once inside, adversaries leveraged T-SQL — a legitimate database feature — to execute system commands, download a Monero cryptocurrency miner, and install the Gh0st RAT remote access trojan. This matters because a compromised database server provides attackers with both a persistent foothold and potential access to sensitive data stored within. The attack is entirely preventable: strong, unique passwords combined with network-level restrictions on database exposure would have stopped it before it started.",[158,159,160,161,162],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 IA-5: Authenticator Management","MITRE ATT&CK T1110: Brute Force","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":164,"MITRE ATT&CK T1110: Brute Force":165,"CIS Control 6: Access Control Management":166,"NIST SP 800-53 IA-5: Authenticator Management":167,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":168},"This point covers access control and asset management, requiring organizations to implement proper controls over who and what can authenticate to critical systems — which would have prevented internet-exposed SQL Servers from being reachable with weak passwords.","The campaign explicitly used a credential brute-force technique against exposed SQL Server authentication endpoints, matching this technique's definition of systematically guessing passwords to gain unauthorized access.","This control mandates strong authentication and least-privilege access for all accounts, which would have prevented the brute-force attack from succeeding against SQL Server logins.","IA-5 requires enforcing minimum password complexity and prohibiting weak or commonly used passwords — the exact gap that allowed attackers to cycle through 2,700 passwords and gain access.","This control requires disabling unnecessary services and default accounts on database servers — directly applicable because attackers exploited weak default-style credentials and dangerous enabled features like xp_cmdshell."]