Security researchers at Fortinet’s FortiGuard Labs have detailed an active campaign that scans the internet for exposed Microsoft SQL Server instances, brute-forces its way in using a list of more than 2,700 passwords, and then installs both a disguised cryptocurrency miner and a remote access trojan. The campaign has been running since at least early October 2026, and FortiGuard rates its severity as high.

Scanning, Guessing, and Getting In

The infection chain begins with a file called dllhost.exe — a name chosen specifically to blend in with a legitimate Windows process. Written in Go and packed with UPX to obscure its contents, the file bundles the open-source Naabu port scanner. It checks in with an attacker-controlled server for an IP range to scan, then probes random addresses in that range for open TCP port 1433, the default listening port for SQL Server, logging any open host it finds before requesting its next range.

A separate component, disguised under the name dwm.exe to resemble the Windows Desktop Window Manager process, handles the actual break-in. Despite the misleading name, it is a .NET credential-guessing tool that reads common usernames such as “sa” and “admin” from one file and attempts logins using more than 2,700 passwords pulled from another — running up to 500 guessing threads simultaneously against each target. Researchers note this is the same fundamental weakness — internet-exposed database servers with weak or reused passwords — that has fueled MS-SQL ransomware intrusions for years.

Turning On xp_cmdshell

Once a login succeeds, the attackers run a script that enables xp_cmdshell, a legitimate SQL Server feature that allows the database engine to execute operating-system commands. From there, the malware downloads a payload into the C:\Users\Public folder under an innocuous name, creates a daily scheduled task disguised as a Microsoft update process, and drops another downloader file into the Startup folder for good measure. The malware also sets up its own recurring task, disguised as a Microsoft Edge update, that runs every 30 minutes.

That downloader then reaches out to an FTP server to pull down eight additional support files, saving them to the Temp folder before execution. It also exfiltrates basic host fingerprinting data to the attackers: the server’s public IP address, country, Windows version, processor and memory details, username, and hostname, effectively registering the newly compromised machine in the operators’ tracking system.

Two Payloads, Two Purposes

The campaign deploys two distinct final-stage tools:

• A disguised Microsoft Edge update file that is in reality a Monero cryptocurrency miner wrapped in two layers of packing to resist analysis. It silently consumes server CPU cycles to mine coins through pools including nanopool and kryptex, and reports back to the attackers’ server whenever mining begins.
• A variant of the long-running Gh0st RAT family, which establishes persistence three separate ways — a registry Run key, a Windows service, and a scheduled task — and gives attackers full remote control. It can log keystrokes, manage files, open a remote shell, wipe Windows event logs, and steal data from the Chinese messaging app QQ. Plugin support adds screen capture and remote desktop access, and the malware actively checks for 78 different security product process names to evade detection.

FortiGuard’s researchers note that the attackers’ command-and-control servers were offline at the time of testing, limiting analysis to the unpacked binaries themselves. The Gh0st RAT family has a long history of targeting MS-SQL servers specifically, including in previously documented campaigns.

Reducing Exposure

FortiGuard’s recommendations are straightforward but frequently overlooked in practice:

• Never expose SQL Server directly to the internet — place it behind a firewall or require VPN access
• Block inbound traffic to port 1433 from outside the network
• Use long, unique, non-reused passwords and rename or disable the default “sa” account
• Enable account lockout after repeated failed login attempts
• Disable xp_cmdshell unless it is specifically required for a business function
• Monitor for unexpected scheduled tasks, particularly ones disguised as routine software updates

The campaign is a reminder that sophisticated malware families like Gh0st RAT still frequently arrive through the simplest possible route: a database server left reachable from the open internet with a password that was never strong enough to begin with.