Overview
- FortiGuard Labs publicly disclosed the campaign on November 12 after finding activity that began in early October, with media follow-up on November 12–14.
- Operators scanned for exposed Microsoft SQL Server instances and used a .NET brute-force tool with a list of more than 2,700 common passwords to gain access.
- Once inside, attackers run T-SQL to enable xp_cmdshell, a SQL Server feature that launches Windows commands under the database service account.
- The intrusions drop two payloads: an XMRig-based Monero miner masquerading as MicrosoftEdgeUpdate.exe that connects to known pools, and a Gh0st RAT variant that can keylog, capture screens, manage files, and steal credentials.
- Researchers found persistence via registry changes, a Windows service and scheduled tasks, identified several command-and-control domains that were partly offline, and urged defenders to remove public exposure, strengthen passwords, disable xp_cmdshell, and hunt IOCs.