FortiGuard Labs has discovered an attack campaign targeting Microsoft SQL Server, in which attackers brute-force the Monero mining program and the Gh0st RAT remote control trojan.
Attackers used a list of over 2700 passwords along with usernames such as "sa" and "admin" to attempt logins. After succeeding, they enabled xp_cmdshell and installed a downloader. The mining program, disguised as MicrosoftEdgeUpdate.exe, consumed CPU resources to mine Monero. A variant of Gh0st RAT possessed keylogging, file management, and remote command capabilities. The malware achieved persistence through registry entries, Windows services, and scheduled tasks. This activity was discovered in early October 2026, and researcher Xiaopeng Zhang published a report on November 12th.
