[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUELWQBo99GlHpgc6pThYuZAD9_3HMn82mRx0uLU4iEw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"f9269a4a-0eec-4fe9-af46-84c551fc5301","weak-sql-server-passwords-enable-brute-force-takeover-and-malware-deployment","46c38cc8-2142-45d7-bb16-1a90d2787a44","Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment","Attackers successfully brute-forced internet-facing Microsoft SQL Server instances using a dictionary of just 2,700 common passwords, highlighting that many organizations are still running database services with weak or default credentials directly exposed to the internet. Once inside, adversaries leveraged T-SQL — a legitimate database feature — to execute system commands, download a Monero cryptocurrency miner, and install the Gh0st RAT remote access trojan. This matters because a compromised database server provides attackers with both a persistent foothold and potential access to sensitive data stored within. The attack is entirely preventable: strong, unique passwords combined with network-level restrictions on database exposure would have stopped it before it started.","**Immediate actions:**\n- Enforce strong, unique passwords (minimum 16 characters) on all SQL Server accounts and disable or rename the default 'sa' account immediately.\n- Remove Microsoft SQL Server from direct internet exposure by placing it behind a firewall or VPN, allowing access only from trusted IP ranges.\n- Audit all SQL Server instances for enabled xp_cmdshell and other dangerous extended stored procedures, disabling any that are not operationally required.\n\n**Long-term improvements:**\n- Implement a privileged access management (PAM) solution to rotate and vault database credentials automatically.\n- Maintain a continuously updated inventory of all internet-facing services and schedule regular attack surface reviews.\n- Apply the principle of least privilege to all SQL Server logins, ensuring application accounts cannot execute OS-level commands.\n\n**Detection measures:**\n- Deploy authentication failure alerting to flag accounts that experience more than five failed logins within a short window, triggering an automatic account lockout.\n- Monitor SQL Server logs for unusual use of T-SQL system procedures (e.g., xp_cmdshell, sp_configure) and outbound network connections from the database process.\n- Integrate SQL Server audit logs with a SIEM to correlate brute-force attempts across multiple database hosts in real time.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 IA-5: Authenticator Management","MITRE ATT&CK T1110: Brute Force","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1110: Brute Force":19,"CIS Control 6: Access Control Management":20,"NIST SP 800-53 IA-5: Authenticator Management":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":22},"This point covers access control and asset management, requiring organizations to implement proper controls over who and what can authenticate to critical systems — which would have prevented internet-exposed SQL Servers from being reachable with weak passwords.","The campaign explicitly used a credential brute-force technique against exposed SQL Server authentication endpoints, matching this technique's definition of systematically guessing passwords to gain unauthorized access.","This control mandates strong authentication and least-privilege access for all accounts, which would have prevented the brute-force attack from succeeding against SQL Server logins.","IA-5 requires enforcing minimum password complexity and prohibiting weak or commonly used passwords — the exact gap that allowed attackers to cycle through 2,700 passwords and gain access.","This control requires disabling unnecessary services and default accounts on database servers — directly applicable because attackers exploited weak default-style credentials and dangerous enabled features like xp_cmdshell.","published","2026-11-13T15:20:23.468976+00:00","2026-11-13T15:20:23.452+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fbreak-into-microsoft-sql-servers\u002F","hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91","Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":34,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]