Microsoft SQL Servers Targeted by Hackers to Deploy Secret Monero Miners

Security researchers at FortiGuard Labs have uncovered a sophisticated cyberattack campaign targeting poorly secured Microsoft SQL (MSSQL) servers globally. Exploiting weak administrative credentials, threat actors are infiltrating databases to deploy a dual-threat payload consisting of a Monero (XMR) cryptocurrency miner and a variant of the Gh0st RAT malware. This campaign highlights the persistent risk of cryptojacking, where unauthorized parties hijack server resources to generate digital assets at the expense of the victim's infrastructure.

Exploitation of Misconfigured Databases

The attackers initiate the breach using brute-force techniques, systematically attempting to guess passwords for servers exposed to the open internet. Once access is gained, the hackers utilize the xp_cmdshell function—a powerful extended stored procedure that allows the execution of operating system commands directly through the SQL Server. While typically disabled by default for security reasons, it is often manually re-enabled by administrators or attackers to facilitate deep system manipulation.

The infiltration process involves several technical stages:

• Identification of vulnerable endpoints via automated scanning tools.
• Execution of brute-force scripts to compromise administrative accounts.
• Re-configuration of system settings to allow shell command execution.
• Deployment of malicious scripts that modify system files to ensure persistence.

Dual-Payload Deployment: Gh0st RAT and XMR Miner

Once the server environment is compromised, the attackers deploy two distinct types of malware. The first is a Monero miner, which is strategically disguised as a legitimate system file named MicrosoftEdgeUpdate.exe. By operating under a name that appears harmless to many monitoring tools, the miner can continuously utilize the server’s CPU power to mine XMR, a privacy-focused cryptocurrency frequently favored by cybercriminals due to its anonymizing features.

In addition to resource theft, the hackers install a variant of the Gh0st RAT (Remote Access Trojan). This malware grants the attackers extensive control over the infected machine, including:

• Keylogging to capture sensitive passwords and credentials.
• Screen capturing to monitor administrative activity in real-time.
• Remote file management and system command execution.

The combination of a cryptocurrency miner and a Remote Access Trojan suggests that the attackers are looking to maximize their profit through both resource theft and long-term espionage or data exfiltration.

To mitigate these risks, security experts recommend that organizations utilizing Microsoft SQL Servers implement strong, unique passwords, restrict access to the xp_cmdshell procedure, and ensure that database servers are protected by robust firewalls or placed within a VPN to prevent direct exposure to the public internet. As of November 2026, the frequency of these automated attacks continues to rise, necessitating proactive monitoring of server resource usage, which often serves as the first indicator of a hidden cryptojacking infection.