# Larva-26009 MS-SQL Server Intrusion Campaign Deploys XMRig, VShell, SoftEther VPN via Multi-Tool Toolkit

> AhnLab ASEC reports a campaign by threat actor Larva-26009 compromising exposed MS-SQL servers to install web shells on IIS, escalate privileges with Potato-family exploits, dump credentials from the registry, and deploy a toolkit including the VShell Go backdoor, SoftEther VPN, Cloudflared proxying, GotoHTTP remote control, and Mimikatz, culminating in XMRig cryptocurrency mining.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1754
- **ID:** TL-2026-1754
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Larva-26009
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab Security Emergency response Center (ASEC) documented an active intrusion campaign attributed to the threat cluster Larva-26009 in which internet-exposed or weak-credentialed Microsoft SQL Server (MS-SQL) instances are compromised for initial command execution. ASEC's telemetry shows only reconnaissance ping commands ("Ping -n 10 127.0.0.1") were logged ahead of malware installation, indicating the initial-access method itself (consistent with brute-force/dictionary login against MS-SQL) leaves a minimal audit trail before the attacker pivots to persistence.

Despite the database-layer entry point, the attackers deploy ASPX and PowerShell web shells (Sharp4WebCmd family, plus a PowerShell shell listening on port 37681 with default credentials "joke"/"jokeyyds666") on the co-hosted IIS web server to guarantee persistence independent of the MS-SQL service itself. A Certutil.exe -decode operation is used to unpack a staged text file (1.txt) into the working ASPX web shell (observed as homename.aspx). The Suo5 HTTP tunneling tool is used to pivot the web shell into a full SOCKS5 proxy for interactive access, wrapping traffic inside HTTP chunked-transfer encoding to blend in with legitimate HTTPS sessions.

Once on the host, the actor runs the Fscan network scanner and standard Windows discovery commands (ipconfig, net group /domain) to map the internal environment, then escalates privileges from a service-account context to NT AUTHORITY\SYSTEM by abusing SeImpersonatePrivilege via the Potato exploit family — JuicyPotatoNG, SigmaPotato, BadPotato, and RustPotato are all present in the toolkit, giving the actor multiple fallback options if one variant is blocked by EDR. With SYSTEM access, the SAM, SECURITY, and SYSTEM registry hives are dumped via "Reg save", and Mimikatz plus the open-source HackBrowserData utility are used to harvest OS credentials and browser-stored passwords/cookies.

For redundant remote access, the actor installs GotoHTTP (a legitimate commercial remote-support tool), the VShell Go-based backdoor, Chrome Remote Desktop, and Cloudflared — deliberately favoring legitimate, digitally-signed software to blend into normal administrator traffic and evade security-product detection. Payloads and staging files (including GotoHTTP_x64.exe, an XMRig archive, a PowerShell downloader script, and shellcode-loader components) are hosted on legitimate public cloud object storage — Cloudflare R2, AWS S3, and Alibaba Cloud OSS buckets — retrieved on-host via "Certutil.exe -urlcache -split -f" and "Bitsadmin /transfer", both living-off-the-land binaries that blend payload retrieval into normal Windows administrative activity. A shellcode-loader chain (RingQ, and a patched/trojanized NVIDIA utility) decrypts DJB2-obfuscated shellcode (main.txt, edgeico.ico, gojoke.png) largely in memory before execution, reducing on-disk artifacts.

To anchor a durable foothold, the actor creates backdoor local accounts using a trailing "$" suffix (MSSQLSERVERS$, mssql$, adminweb1$) and installs SoftEther VPN configured as a "Cascade Connection" — rather than terminating locally, the compromised host's VPN service relays to an upstream VPN server operated by the actor, adding a hop that frustrates network-layer attribution of the true C2 endpoint (the same cascade technique ASEC previously documented on a compromised Korean ERP server). The campaign concludes with deployment of the XMRig cryptocurrency miner, monetizing the compromised MS-SQL/IIS host via unauthorized Monero mining — the same commercial motive ASEC has repeatedly observed across the broader "Larva"-numbered cluster of MS-SQL-focused intrusion sets it tracks.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1197 BITS Jobs
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1069 Permission Groups Discovery
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy
- T1102 Web Service
- T1071 Application Layer Protocol
- T1496 Resource Hijacking
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities

## Sources

- [Larva-26009 Threat Group Attacking MS-SQL Servers](https://asec.ahnlab.com/en/94685/)
- [Case of Attack Targeting MS-SQL Servers Abusing GotoHTTP](https://asec.ahnlab.com/en/83283/)
- [Analysis of Attack Case Installing SoftEther VPN on Korean ERP Server](https://asec.ahnlab.com/en/74079/)
- [Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool](https://thehackernews.com/2025/04/chinese-hackers-target-linux-systems.html)
- [zema1/suo5 — A high-performance HTTP proxy tunneling tool](https://github.com/zema1/suo5)
- [VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)](https://unit42.paloaltonetworks.com/beyondtrust-cve-2026-1731/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1754