Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems. The activity highlights the persistent challenge of securing privileged access …

Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker - National Cyber Security Consulting

SEO: Fortinet discovered a campaign where attackers brute-force exposed Microsoft SQL Server installations and abuse T-SQL commands to deploy a Monero miner and Gh0st RAT on Windows systems. A weak Microsoft SQL Server password can offer attackers more than access to a database- it can also allow them to run programs on the Windows machine […] Thank you for subscribing to our RSS feed!

Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT

Fortinet finds weak SQL Server passwords used to deliver a miner and Gh0st RAT Read more →

Weak passwords and SQL used in Gh0st RAT attack against Microsoft users

FortiGuard Labs has shared new research on a threat campaign first uncovered in October. The campaign has been using brute-force attempts against internet-facing Microsoft SQL Server logins, then running T-SQL commands to install a Monero crypto miner and Gh0st Remote Access Trojan malware. “The malware scans IP ranges for exposed SQL Servers and attempts to log in using supplied credentials,” FortiGuard Labs said. Once it gains access, it remot…