Threat reportMalwareTL-2026-1754
Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig, VShell, SoftEther VPN via Multi-Tool Toolkit
Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig (TL-2026-1754) is a high-severity malware campaign, first published 2026-07-25. It is attributed to Larva-26009 with medium confidence, affects Microsoft SQL Server, maps to 29 MITRE ATT&CK techniques (T1003, T1005, T1016), and is covered by 9 detection rules and 40 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 29MITRE ATT&CK
- Actors
- 1Larva-26009
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 40Indicators of compromise
Key facts for TL-2026-1754
- Threat ID
- TL-2026-1754
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Larva-26009
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
Malware and tooling: MimiKatz, VShell, xmrig, Fscan, GotoHTTP, HackBrowserData, RingQ, SoftEther VPN (Cascade Connection), Suo5
How Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig works
AhnLab ASEC reports a campaign by threat actor Larva-26009 compromising exposed MS-SQL servers to install web shells on IIS, escalate privileges with Potato-family exploits, dump credentials from the registry, and deploy a toolkit including the VShell Go backdoor, SoftEther VPN, Cloudflared proxying, GotoHTTP remote control, and Mimikatz, culminating in XMRig cryptocurrency mining.
AhnLab Security Emergency response Center (ASEC) documented an active intrusion campaign attributed to the threat cluster Larva-26009 in which internet-exposed or weak-credentialed Microsoft SQL Server (MS-SQL) instances are compromised for initial command execution. ASEC's telemetry shows only reconnaissance ping commands ("Ping -n 10 127.0.0.1") were logged ahead of malware installation, indicating the initial-access method itself (consistent with brute-force/dictionary login against MS-SQL) leaves a minimal audit trail before the attacker pivots to persistence.
Despite the database-layer entry point, the attackers deploy ASPX and PowerShell web shells (Sharp4WebCmd family, plus a PowerShell shell listening on port 37681 with default credentials "joke"/"jokeyyds666") on the co-hosted IIS web server to guarantee persistence independent of the MS-SQL service itself. A Certutil.exe -decode operation is used to unpack a staged text file (1.txt) into the working ASPX web shell (observed as homename.aspx). The Suo5 HTTP tunneling tool is used to pivot the web shell into a full SOCKS5 proxy for interactive access, wrapping traffic inside HTTP chunked-transfer encoding to blend in with legitimate HTTPS sessions.
Once on the host, the actor runs the Fscan network scanner and standard Windows discovery commands (ipconfig, net group /domain) to map the internal environment, then escalates privileges from a service-account context to NT AUTHORITY\SYSTEM by abusing SeImpersonatePrivilege via the Potato exploit family — JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato are all present in the toolkit, giving the actor multiple fallback options if one variant is blocked by EDR. With SYSTEM access, the SAM, SECURITY, and SYSTEM registry hives are dumped via "Reg save", and Mimikatz plus the open-source HackBrowserData utility are used to harvest OS credentials and browser-stored passwords/cookies.
For redundant remote access, the actor installs GotoHTTP (a legitimate commercial remote-support tool), the VShell Go-based backdoor, Chrome Remote Desktop, and Cloudflared — deliberately favoring legitimate, digitally-signed software to blend into normal administrator traffic and evade security-product detection. Payloads and staging files (including GotoHTTP_x64.exe, an XMRig archive, a PowerShell downloader script, and shellcode-loader components) are hosted on legitimate public cloud object storage — Cloudflare R2, AWS S3, and Alibaba Cloud OSS buckets — retrieved on-host via "Certutil.exe -urlcache -split -f" and "Bitsadmin /transfer", both living-off-the-land binaries that blend payload retrieval into normal Windows administrative activity. A shellcode-loader chain (RingQ, and a patched/trojanized NVIDIA utility) decrypts DJB2-obfuscated shellcode (main.txt, edgeico.ico, gojoke.png) largely in memory before execution, reducing on-disk artifacts.
To anchor a durable foothold, the actor creates backdoor local accounts using a trailing "$" suffix (MSSQLSERVERS$, mssql$, adminweb1$) and installs SoftEther VPN configured as a "Cascade Connection" — rather than terminating locally, the compromised host's VPN service relays to an upstream VPN server operated by the actor, adding a hop that frustrates network-layer attribution of the true C2 endpoint (the same cascade technique ASEC previously documented on a compromised Korean ERP server). The campaign concludes with deployment of the XMRig cryptocurrency miner, monetizing the compromised MS-SQL/IIS host via unauthorized Monero mining — the same commercial motive ASEC has repeatedly observed across the broader "Larva"-numbered cluster of MS-SQL-focused intrusion sets it tracks.
MITRE ATT&CK techniques used in TL-2026-1754
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Collection
Discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling
credential-access
Persistence
T1136 Create Account; T1197 BITS Jobs; T1505 Server Software Component
Initial Access
T1190 Exploit Public-Facing Application
Impact
Resource Development
Affected products and versions in Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
- Microsoft — SQL Server
Vulnerable versions: Internet-exposed or misconfigured instances with weak/default credentials
Fixed in: N/A — not a version-specific vulnerability; mitigated via credential hardening and network access restriction - Microsoft — Internet Information Services (IIS)
Vulnerable versions: Web servers co-hosted with a compromised MS-SQL instance, used for web shell persistence
Fixed in: N/A
Remediation for Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
Patches
- No vendor CVE/patch applies — the intrusion vector is weak/exposed MS-SQL authentication and living-off-the-land tooling, not a specific software vulnerability; remediate via credential hardening and network exposure reduction
Immediate actions
- Restrict or remove public internet exposure of MS-SQL (TCP/1433 or configured port); place instances behind firewall allow-lists/VPN
- Enforce strong, unique MS-SQL credentials (including the sa account) and lock out or disable accounts after repeated failed logins
- Audit local accounts for unauthorized entries with a trailing '$' suffix (e.g., MSSQLSERVERS$, mssql$, adminweb1$) and remove them
- Hunt for and remove unauthorized ASPX/PowerShell web shells under IIS web roots co-hosted with MS-SQL, including recently modified .aspx files and any service listening on port 37681
- Block outbound traffic to identified C2 infrastructure: 159.223.46.140, 38.60.253.35, microsftapiedge.com, update.microsftapiedge.com
- Identify and remove unauthorized installations of SoftEther VPN, Cloudflared, GotoHTTP, and Chrome Remote Desktop on database/web servers
Workarounds
- Enable MS-SQL login auditing and alert on repeated failed authentication attempts from external IPs
- Restrict xp_cmdshell execution rights to only the specific service accounts that require it
- Enforce network segmentation so database servers cannot reach arbitrary public cloud object-storage endpoints (Cloudflare R2, AWS S3, Alibaba Cloud OSS) except where explicitly required
Longer-term hardening
- Disable xp_cmdshell and other unnecessary MS-SQL extended stored procedures on production instances that do not require OS command execution
- Deploy EDR/behavioral detection tuned for LOLBIN abuse (certutil -urlcache, bitsadmin /transfer) and Potato-family SeImpersonatePrivilege/token-impersonation techniques
- Restrict SeImpersonatePrivilege and SeAssignPrimaryTokenPrivilege on service accounts to the minimum required, and segment database servers from unrestricted outbound egress
- Implement application allow-listing on server workloads to block unauthorized remote-access software (GotoHTTP-class tools, Cloudflared, Chrome Remote Desktop) outside of approved change windows
- Monitor for anomalous outbound HTTP tunneling behavior (chunked-transfer-encoding proxy patterns consistent with Suo5) and for SoftEther cascade/relay configurations on server assets
Weaknesses (CWE) in Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
Timeline of Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
- AhnLab ASEC publishes technical analysis of the Larva-26009 campaign, naming the multi-tool toolkit and publishing the associated IOC set.
- XMRig is downloaded via Certutil/Bitsadmin from Cloudflare R2, AWS S3, and Alibaba Cloud OSS staging buckets and executed for Monero cryptocurrency mining as the campaign's final-stage monetization payload.
- SoftEther VPN is configured in 'Cascade Connection' mode, chaining the compromised host to upstream actor-controlled VPN infrastructure to obscure the true C2 endpoint.
- Backdoor local accounts with a trailing '$' suffix (MSSQLSERVERS$, mssql$, adminweb1$) are created, and GotoHTTP, the VShell backdoor, Chrome Remote Desktop, and Cloudflared are installed for redundant remote access.
- The SYSTEM, SAM, and SECURITY registry hives are dumped via 'reg save', and Mimikatz plus HackBrowserData are used to harvest OS and browser-stored credentials.
- SeImpersonatePrivilege is abused via the Potato exploit family (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato) to escalate to NT AUTHORITY\SYSTEM.
- The Fscan network scanner and Windows discovery commands (ipconfig, net group /domain) are run to map the internal environment and identify further targets.
- A certutil-decoded ASPX web shell (Sharp4WebCmd family, observed as homename.aspx) and a PowerShell-based web shell listening on port 37681 are installed on the co-hosted IIS web server for persistence.
- Attackers gain command execution on an internet-exposed or weak-credentialed MS-SQL server; only reconnaissance ping commands (Ping -n 10 127.0.0.1) are logged prior to malware installation, per ASEC's incident analysis.
Sources cited for Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig
- Larva-26009 Threat Group Attacking MS-SQL Servers
- Case of Attack Targeting MS-SQL Servers Abusing GotoHTTP
- Analysis of Attack Case Installing SoftEther VPN on Korean ERP Server
- Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool
- zema1/suo5 — A high-performance HTTP proxy tunneling tool
- VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)
Detection coverage for TL-2026-1754
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1754 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.