NewsCSO Online

    Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

    Share
    An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems. The activity highlights the persistent challenge of securing privileged access across complex and often legacy infrastructure, said Shane Barney , chief information security officer at Keeper Security. “While internet-facing databases are sometimes the unintended result of technical debt or misconfigurations, relying on static, standing credentials is what turns that exposure into a critical vulnerability,” he said. “When administrative logins can be brute-forced, attackers gain immediate, unchecked control to deploy malware without needing a single complex exploit.” The campaign delivers two distinct payloads: an XMRig-based Monero cryptocurrency miner that hijacks the compromised servers’ computing resources, and a Gh0st remote access trojan ( RAT ) variant that gives attackers remote access and capabilities such as keylogging and data theft. Microsoft did not immediately respond to a request for comment. Brute-forcing SQL logins to get Windows commands The campaign begins with a Go-based payload named “dllhost.exe,” which runs the open-source Naabu port scanner, FortiGuard researcher Xiaopeng Zhang said in a disclosure shared with CSO ahead of its publication on Thursday. The payload retrieves target IP ranges from an attacker-controlled server, converts them into CIDR ranges, and scans randomly generated addresses for systems with TCP port 1433 open. This is the default port used by Microsoft SQL Server. Once reachable servers are identified, the malware records their IP addresses and launches a brute-force attack using a separate executable named “dwn.exe.” The tool attempts to authenticate with usernames such as “sa” and “admin,” alongside a predefined password list containing more than 2700 entries. Successful logins give attackers more than database access, Zhang said. The malware executes a series of malicious T-SQL commands contained in a file named 2018.sql, using SQL Server’s administrative functionality to run commands on the compromised Windows machine. Among other things, the commands enable xp_cmdshell, a SQL Server feature that allows database administrators to execute Windows command shell operations. The attackers then use it to download or extract executables into the server’s “C:\Users\Public” directory and run them. Jason Soroko , senior fellow at Sectigo, said the campaign effectively turns a database login into a way to execute malware on the server. “Organizations should remove direct internet access to SQL Server, restrict connections to approved systems, and enforce strong, unique credentials,” he said. “Administrative access should be limited to accounts that need it.” Soroko also recommended keeping xp_cmdshell disabled unless required and monitoring attempts to enable it. A cryptominer and a Gh0st RAT come along for the ride The malicious T-SQL commands deploy a loader that retrieves additional executables from the attackers’ FTP infrastructure, including a Monero cryptocurrency miner and a variant of the Gh0st RAT. FortiGuard observed a payload, MicrosoftEdgeUpdate.exe, posing as a legitimate browser update but actually turning out to be an XMRig-based cryptocurrency miner. It uses the compromised server’s CPU resources to mine Monero and communicates with mining pools using a wallet address embedded in its configuration. The Gh0st RAT variant was delivered through “Winlogon.exe.” The researchers identified functionality for keylogging, file management, data theft, remote shell execution, and process management, alongside more than 30 control commands. Its capabilities also include screen capture and remote desktop access through plugins. The attack was found using multiple persistence mechanisms to maintain access. The initial payload creates a scheduled task running every 30 minutes, while the downloader establishes another task to repeatedly execute daily at 1 AM. The Gh0st RAT, meanwhile, adds itself to the Windows registry’s Run key, installs a Windows service and creates a scheduled task that launches it every 30 minutes. Barney said cryptominers may serve as a distraction from the more serious implications of an intrusion. Attackers, he noted, can use mining activity as “a smokescreen for establishing long-term persistence through remote access tools.” FortiGuard said it provides detection coverage for the campaign through its FortiGuard IPS, Web Filtering, and Antivirus services. For those who aren’t its customers, the company shared a list of indicators of compromise (IoCs) to help catch potential infections.

    More on cryptominers

    Other news entries

    Source: https://www.csoonline.com/article/4247845/hackers-abuse-sql-servers-weak-passwords-to-drop-cryptominers-and-gh0st-rat.html

    ID