Weak SQL Server Passwords Are Buying Someone a Monero Miner

Someone is going door to door across the internet looking for Microsoft SQL Servers with weak passwords, and once inside, using the database’s own command language to install a crypto miner and a remote-access trojan. FortiGuard Labs says the campaign, found in early October 2026, uses a Go scanner to hunt for port 1433, a .NET tool with 2,700-plus stock passwords to break in, and a batch of T-SQL commands that switch on xp_cmdshell and pull down the next stage. The payloads Fortinet recovered were an XMRig Monero miner and a Gh0st RAT variant, both dressed up as Windows and Edge files.

site.vietnam852[.]com:88, ftp.vietnam852[.]com:88 (staging, FTP)
server.vietnam852[.]com:8000, www.swordaa[.]com:8000 (Gh0st RAT C2)
site.hfgjjkrewjk[.]com, site.jiancai008[.]com (staging, miner check-in)
hxxp://site.vietnam852[.]com:88/ip.php (target-range feed)

%TEMP%\Result.txt, 2018.sql, dwm.exe (CSQL.exe), go.vbs, go.bat, out.bat
C:\Users\Public\Secs.exe, C:\Users\Public\Google.exe, C:\Users\Public\payload.exe
Tasks: Microsoft_UPDATES, MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2}, MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}

Source article: T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers
Publisher: FortiGuard Labs, Fortinet (author: Xiaopeng Zhang)
Published: Nov. 12, 2026
URL: https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers

Executive Summary

FortiGuard Labs describes an unattributed, financially motivated campaign, active since at least early October 2026, that compromises Microsoft SQL Server instances exposed to the internet; no actor name or vendor alias is reported. The entry point is a UPX-packed Go binary named dllhost.exe that embeds the open-source Naabu scanner, persists through a scheduled task named after a Microsoft Edge updater, fetches a target address from hxxp://site.vietnam852[.]com:88/ip.php, widens it to a /16 and SYN-scans for TCP 1433, logging open hosts to %TEMP%\Result.txt. It downloads eight supporting files into %TEMP%; go.vbs launches go.bat, which runs dwm.exe (a .NET brute-forcer whose assembly name is CSQL.exe) against each open server with usernames such as sa and admin and more than 2,700 stock passwords. On a successful login dwm.exe runs the batches in 2018.sql, which enable xp_cmdshell, download a loader into C:\Users\Public as Google.exe or payload.exe, register a daily task named Microsoft_UPDATES, and extract an embedded loader to C:\Users\Public\Secs.exe with a Startup-folder copy. Secs.exe registers the host over HTTP, sets its own Edge-lookalike task and pulls further payloads from ftp.vietnam852[.]com: an XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe that reports to a Kryptex pool, and a Themida-packed Gh0st RAT variant disguised as winlogon.exe with a Run key, a service and a 30-minute task for persistence, keylogging, a remote shell, event-log clearing and more than 30 control commands. The impact is stolen compute, full remote control of database servers and each compromised server being turned into a new scanner. No vulnerability is exploited; weak SQL authentication is the root cause. Hunt leads, false positive expectations and indicators are detailed below; Fortinet published SHA-256 hashes and AV signature names but no YARA or Sigma rules.

ATT&CK chain: Discovery → Credential Access → Initial Access → Execution → Persistence → Defense Evasion → Command and Control → Impact

Hunt Lead Grid

vietnam852 Infrastructure Sweep

The scanner asks hxxp://site.vietnam852[.]com:88/ip.php for each new target range, the supporting files come from hxxp://site.vietnam852[.]com:88/2026/ (2018.sql, dwm.exe, go.bat, go.vbs, out.bat, pass.txt, sqlcmd.exe, user.txt), the T-SQL downloads down.exe from the same host or ftp.vietnam852[.]com, Secs.exe registers victims at hxxp://ftp.vietnam852[.]com:88/post.php and pulls payloads from /test/ paths on ftp.vietnam852[.]com:88 and site.jiancai008[.]com:88, the miner reports to /tj/xmr.php on site.vietnam852[.]com and site.hfgjjkrewjk[.]com with the user agent “XMRig Reporter”, and the Gh0st RAT beacons to server.vietnam852[.]com:8000 and www.swordaa[.]com:8000. The detection logic is a retrospective search of DNS, proxy and firewall logs for any of these hostnames, for HTTP to port 88 or TCP to port 8000 on them, and for the “XMRig Reporter” user agent.

Use DNS resolver logs, web proxy logs, firewall and NetFlow records, and EDR network telemetry from database servers. Sweep back to at least September 2026 to cover the campaign’s start. Database servers rarely browse the web, so any outbound HTTP or FTP from a SQL Server host to these names is already an incident. Block the domains at DNS and egress, but do not stop there: the operator can rotate hostnames, so also pair this with the host artifact and xp_cmdshell leads. Any hit should be escalated to incident response with the server’s SQL logins treated as compromised.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), T1071.001 (Application Layer Protocol: Web Protocols), T1071.002 (Application Layer Protocol: File Transfer Protocols)

Sources: “T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers”, FortiGuard Labs, Nov. 12, 2026, https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers (source article)

Edge-Lookalike Tasks and Public-Folder Loaders

Fortinet documents three task names and a handful of fixed paths. The scanner creates MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} running dllhost.exe every 30 minutes (the sample used E:\dllhost.exe); the T-SQL batch registers a daily task named Microsoft_UPDATES on the database server; and Secs.exe creates MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159} running C:\Users\Public\Secs.exe daily at 01:00. Files land as C:\Users\Public\Google.exe, C:\Users\Public\payload.exe and C:\Users\Public\Secs.exe with a copy in the Startup folder, while the scanner stages Result.txt, 2018.sql, dwm.exe, go.vbs, go.bat, out.bat, user.txt, pass.txt and sqlcmd.exe in %TEMP%. Gh0st RAT adds winlogon.exe to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, installs a service and a 30-minute task. The detection logic is to enumerate scheduled tasks (Security event 4698, the TaskScheduler Operational log and the Tasks folder) for these names and for any Edge-named task whose action is outside the Edge program folder, and to sweep for executables in C:\Users\Public and for winlogon.exe, MicrosoftEdgeUpdate.exe or dllhost.exe running from anywhere other than their genuine system or program paths.

Use EDR file and process telemetry, Windows task scheduler logs, registry Run-key auditing and service-creation events (System 7045). Sweep the full retention window on every SQL Server host, since the tasks re-launch the malware indefinitely. Real Edge updater tasks are named similarly, so allowlist by the action path (the signed MicrosoftEdgeUpdate.exe under Program Files (x86)\Microsoft\EdgeUpdate) rather than by task name. Do not hash-block winlogon.exe or dllhost.exe by name; the genuine binaries are critical system files, and detection should key on path and parentage. A match on any of these artifacts means the server ran attacker code: isolate it, rotate every SQL and Windows credential on it, and rebuild rather than clean.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task), T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder), T1543.003 (Create or Modify System Process: Windows Service); Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location) (mapping per source article)

Sources: FortiGuard Labs (above), source article

xp_cmdshell Enabled and sqlservr Spawning Shells

Right after a successful login, dwm.exe executes 2018.sql in GO-separated batches. The first switches on xp_cmdshell; later batches use it to download down.exe from hxxp://site.vietnam852[.]com:88/down.exe or ftp.vietnam852[.]com, save it in C:\Users\Public as Google.exe or payload.exe and run it, register the Microsoft_UPDATES task, and write an executable held in an @DATA variable to C:\Users\Public\Secs.exe. Every one of those actions shows up as a child process of sqlservr.exe. The detection logic has two parts: alert on the configuration change itself (sp_configure setting ‘xp_cmdshell’ to 1, usually preceded by ‘show advanced options’, which SQL Server records in its error log and in default trace or audit events), and alert when sqlservr.exe spawns cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, ftp.exe or schtasks.exe, or writes an executable to C:\Users\Public or %TEMP%.

Use SQL Server audit or the default trace for configuration changes, the SQL Server error log, and EDR process-creation telemetry (Sysmon event 1 or Security 4688 with command lines) on database hosts. Sweep 90 days. Some estates still run legitimate jobs through xp_cmdshell; inventory those and allowlist them by the exact command line and the SQL Agent job that owns them, not by the parent process, because the parent is the same in both cases. Turning xp_cmdshell off is the right control but not a detection; an attacker with sysadmin can turn it back on, which is why the configuration-change alert matters. Any sqlservr.exe child that downloads or launches an executable should be escalated immediately. The lead generalizes to most SQL Server intrusions, whoever runs them.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1505.001 (Server Software Component: SQL Stored Procedures); Execution → T1059.003 (Command and Scripting Interpreter: Windows Command Shell); Command and Control → T1105 (Ingress Tool Transfer) (mapping per source article)

Sources: FortiGuard Labs (above), source article

Internet-Facing SQL Login Brute Force

dwm.exe is launched as “dwm.exe -i Result.txt -u user.txt -p pass.txt -t 500 -o out.txt -q 2018.sql”: up to 500 threads cycling usernames such as sa and admin through more than 2,700 predefined passwords against every open server the scanner found. On the target this produces a burst of failed SQL logins (event 18456, “Login failed for user ‘sa'”) from one external address, and on a weak password a successful login from the same address seconds later. The detection logic is to count failed SQL authentications per source address over a short window, alert when a source exceeds a threshold or tries more than one well-known account, and raise the alert to critical when the same source then logs in successfully.

Use the SQL Server error log or audit with failed-login auditing enabled, Windows Application log event 18456, and firewall logs for inbound 1433. Sweep 90 days, since a password guessed weeks ago may still work. Internet-wide scanners touch 1433 all day, so suppress sources that only connect without authenticating and focus on authentication attempts; known application servers that fail logins after a password change can be allowlisted by source and login name. Account lockout is a weak fix because sa is often excluded from password policy and lockout itself can break production; the durable fixes are not exposing 1433, disabling sa and enforcing strong passwords. A brute-force burst followed by success should be handled as a compromise of that server and of any credentials it stores.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1110.001 (Brute Force: Password Guessing) (mapping per source article); Initial Access → T1078.001 (Valid Accounts: Default Accounts)

Sources: FortiGuard Labs (above), source article

Compromised Server Turned Scanner and Miner

Once dllhost.exe is running, the host fetches a target address, converts it to a /16 and sends TCP SYN packets to port 1433 on random addresses across that range, then asks for another range and repeats, while go.bat brute-forces whatever answers. On infected database servers the miner (MicrosoftEdgeUpdate.exe, XMRig behind Themida and a custom LZSS packer) connects to xmr-ru.kryptex.network on port 7029 and reports through an HTTP GET to /tj/xmr.php with the user agent “XMRig Reporter”. The detection logic correlates three things on one host inside a sliding window: a large number of distinct external destinations on TCP 1433 with mostly unanswered SYNs, a recently created process from an unusual path (dllhost.exe outside System32, or anything in %TEMP% or C:\Users\Public) owning those connections, and either mining-pool traffic, sustained high CPU from a process named like an Edge updater, or the C2 connections on port 8000.

This needs NetFlow or firewall session logs with per-host fan-out counts, EDR process-to-network attribution and host performance telemetry, joined by host over windows of an hour or more. Baseline normal outbound 1433 for two weeks and allowlist vulnerability scanners, inventory tools and application servers that legitimately reach many databases. Blocking the one mining pool is the wrong primary control because XMRig configurations carry several pools and operators swap them; the anchor is the combination of fan-out scanning and a masquerading process. A match means the host is both compromised and attacking others: isolate it, notify upstream providers if the scanning reached third parties, and check every server it touched on 1433.

Hunt Lead Level: 3 (Elite)

ATT&CK: Discovery → T1046 (Network Service Discovery); Impact → T1496.001 (Resource Hijacking: Compute Hijacking) (Fortinet lists the parent T1496 (Resource Hijacking)); Defense Evasion → T1027.002 (Obfuscated Files or Information: Software Packing)

Sources: FortiGuard Labs (above), source article

Hash Appendix

Scanner and brute-force kit

SHA-256 values come from the source article. Fortinet did not publish MD5 or SHA1 values; OTX AlienVault and VirusTotal were not queried for this report. sqlcmd.exe may be Microsoft’s legitimate command-line client renamed or bundled; do not hash-block it without checking, and detect it by path (%TEMP%) and parent (go.bat or out.bat) instead.

MD5s

(not available)  # dllhost.exe -> UPX-packed Go scanner with Naabu
(not available)  # 2018.sql -> malicious T-SQL batches
(not available)  # go.bat -> launches dwm.exe brute-forcer
(not available)  # go.vbs -> entry script, starts go.bat and out.bat
(not available)  # out.bat -> helper batch
(not available)  # sqlcmd.exe -> SQL command-line client in %TEMP%
(not available)  # dwm.exe -> .NET MSSQL brute-forcer (CSQL.exe)

SHA1s

(not available)  # dllhost.exe -> UPX-packed Go scanner with Naabu
(not available)  # 2018.sql -> malicious T-SQL batches
(not available)  # go.bat -> launches dwm.exe brute-forcer
(not available)  # go.vbs -> entry script, starts go.bat and out.bat
(not available)  # out.bat -> helper batch
(not available)  # sqlcmd.exe -> SQL command-line client in %TEMP%
(not available)  # dwm.exe -> .NET MSSQL brute-forcer (CSQL.exe)

SHA256s

8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d  # dllhost.exe -> UPX-packed Go scanner with Naabu
f5444e8e9e9e019693aacb363b7441ac0b8ecfe96a77fd94b9c312a017588eb4  # 2018.sql -> malicious T-SQL batches
2a0d2889241885d5ea6fe7dd1b1adc83653a0c07b8aaa1b0832e5f9c0225b379  # go.bat -> launches dwm.exe brute-forcer
79596cf6e267ef5cb658bd97d04e42a41001d36595e370441adb3c2b5dd5666c  # go.vbs -> entry script, starts go.bat and out.bat
e9d3fd9093c476b8b5de19aa00c50758568649def6491f54fa3e0aba4ea31ac9  # out.bat -> helper batch
d6e3fd28f479138b336e2c2088ad2e86b7646a163aa453b1703905a4b359070f  # sqlcmd.exe -> SQL command-line client in %TEMP%
124774698fd3ede0800015d19c2bd6c1869d03bbc2e6e8dbe2f69d2978f7f4d0  # dwm.exe -> .NET MSSQL brute-forcer (CSQL.exe)

Loaders dropped through T-SQL

SHA-256 values come from the source article; MD5 and SHA1 were not published and OTX AlienVault and VirusTotal were not queried.

MD5s

(not available)  # down.exe variant 1 -> C:\Users\Public\Google.exe or payload.exe
(not available)  # down.exe variant 2 -> C:\Users\Public\Google.exe or payload.exe
(not available)  # Secs.exe -> embedded loader extracted from 2018.sql to C:\Users\Public

SHA1s

(not available)  # down.exe variant 1 -> C:\Users\Public\Google.exe or payload.exe
(not available)  # down.exe variant 2 -> C:\Users\Public\Google.exe or payload.exe
(not available)  # Secs.exe -> embedded loader extracted from 2018.sql to C:\Users\Public

SHA256s

125d3a0efe7699bb20397c13f0f4993ad893952727487b4d190e386a5b14c427  # down.exe variant 1 -> C:\Users\Public\Google.exe or payload.exe
20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0  # down.exe variant 2 -> C:\Users\Public\Google.exe or payload.exe
58db0ca2054abe2989412d7a1c8ed16718577f893c196825c848fcd56c7e8f05  # Secs.exe -> embedded loader extracted from 2018.sql to C:\Users\Public

XMRig miner and Gh0st RAT

SHA-256 values come from the source article; MD5 and SHA1 were not published and OTX AlienVault and VirusTotal were not queried.

MD5s

(not available)  # MicrosoftEdgeUpdate.exe variant 1 -> XMRig Monero miner, %TEMP%
(not available)  # MicrosoftEdgeUpdate.exe variant 2 -> XMRig Monero miner, %TEMP%
(not available)  # winlogon.exe -> Gh0st RAT variant, %TEMP%

SHA1s

(not available)  # MicrosoftEdgeUpdate.exe variant 1 -> XMRig Monero miner, %TEMP%
(not available)  # MicrosoftEdgeUpdate.exe variant 2 -> XMRig Monero miner, %TEMP%
(not available)  # winlogon.exe -> Gh0st RAT variant, %TEMP%

SHA256s

2a23e10bfc097e98295cbff8124bd403c4cb677e709b48ccc53d6aca216c3061  # MicrosoftEdgeUpdate.exe variant 1 -> XMRig Monero miner, %TEMP%
da4128aa5d006e05c58f0d240c2d8e5fb02774b6acf314f1230059c7a3498724  # MicrosoftEdgeUpdate.exe variant 2 -> XMRig Monero miner, %TEMP%
3f64b0146b323c5716043360e84384a5a197a897f46088df93a910470a29e1a0  # winlogon.exe -> Gh0st RAT variant, %TEMP%

References Appendix

• “T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers”, FortiGuard Labs, Fortinet (Xiaopeng Zhang), Nov. 12, 2026, https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers (source article; infection chain, commands, task names, IOCs, SHA-256 hashes, ATT&CK mapping)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/