T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers
An active campaign discovered in October 2026 targets Internet-facing Microsoft SQL Server instances using T-SQL commands to deliver malicious payloads. Attackers scan IP ranges for exposed servers on TCP port 1433 and perform brute-force attacks using predefined credentials. Upon successful authentication, malicious T-SQL commands download and execute additional malware on compromised servers. The attack chain deploys a UPX-packed Go binary incorporating the Naabu scanner, which retrieves target IP ranges and performs port scanning. Compromised servers are infected with an XMRig cryptocurrency miner that hijacks CPU resources for Monero mining and Gh0st RAT providing remote access capabilities including keylogging, screen capture, file management, and over 30 control commands for complete system compromise.
Pulse ID: 6af5e2153359d5f8fa91aa75
Pulse Link: https://otx.alienvault.com/pulse/6af5e2153359d5f8fa91aa75
Pulse Author: AlienVault
Created: 2026-11-12 15:58:13
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
