Threat reportMalwareTL-2026-3451
Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell, Remote Access Tools
Q3 2026 Malware Campaigns Targeting Windows Database Servers (TL-2026-3451), also tracked as Larva-26009 MS-SQL campaign, is a medium-severity malware campaign, first published 2026-10-14. It is attributed to Larva-26009 with low confidence, affects Microsoft SQL Server (Windows, internet-exposed, weak credentials), maps to 21 MITRE ATT&CK techniques (T1003.002, T1021.001, T1027), and is covered by 9 detection rules and 37 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1Larva-26009
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 37Indicators of compromise
Key facts for TL-2026-3451
- Threat ID
- TL-2026-3451
- Also known as
- Larva-26009 MS-SQL campaign
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Larva-26009
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, enterprise, web hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 37
Malware and tooling in Q3 2026 Malware Campaigns Targeting Windows Database Servers
Malware and tooling: Coinminer, GoToHTTP, HackBrowserData, Sharp4WebCmd, Suo5, VShell, xmrig, BadPotato, Chrome Remote Desktop, Cloudflared, Fscan, GotoHTTP
How Q3 2026 Malware Campaigns Targeting Windows Database Servers works
AhnLab ASEC's Q3 2026 report describes attacks on Windows MS-SQL and MySQL servers that begin with brute-force/dictionary attacks or poor account management and lead to payload download, web shell persistence, credential theft, internal scanning, and XMRig/SoftEther VPN deployment. The IOCs overlap with a July 2026 ASEC case study attributed to Larva-26009. No CVE is cited.
AhnLab Security Intelligence Center (ASEC) published its Q3 2026 statistical report on malware targeting Windows database servers on 2026-10-08. The report covers MS-SQL and MySQL servers on Windows that are exposed to the internet and poorly managed. Initial access is described as brute-force and dictionary attacks combined with improper account management, plus exploitation of vulnerabilities. Once the attacker can run commands through the database server, they download additional payloads.
The tools named in the report are XMRig (Monero CoinMiner), GotoHTTP (remote access backdoor, executed in memory), SoftEther VPN (operated in Cascade Connection mode as C&C/tunnel infrastructure), Sharp4WebCmd and Suo5 (ASPX web shells; Suo5 provides tunneling), a PowerShell web shell that authenticates with the username 'joke', VShell (Go-based backdoor with remote execution and file management), HackBrowserData (browser credential stealer), Fscan (internal network scanner), Cloudflared (exposes local ports through a tunnel) and RingQ (encrypted file execution). Credential theft included 'reg save HKLM\SYSTEM' commands. Persistent RDP access was set up through backdoor accounts named MSSQLSERVERS$ and mssql$.
A related ASEC case study published 2026-07-25 attributes a targeted MS-SQL intrusion to the actor Larva-26009. It shares the same payload URLs, domains, IPs and several hashes with the Q3 report. That case study adds privilege-escalation tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato), Chrome Remote Desktop, a Mimikatz VShell plugin, a third backdoor account (adminweb1$), and a payload URL on Cloudflare R2. The Q3 report itself gives no attribution, so the actor link rests on IOC overlap and carries low confidence for the Q3 activity as a whole. Severity is an analyst assessment, since no CVE or CVSS is given. Network IOCs were checked against BeaconBeagle: the beacon lookups for both IPs returned HTTP 404 and the config search for microsftapiedge.com returned zero results, so there are no C2 correlations.
MITRE ATT&CK techniques used in TL-2026-3451
Credential Access
T1003.002 OS Credential Dumping: Security Account Manager; T1110 Brute Force; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1197 BITS Jobs; T1564.002 Hide Artifacts: Hidden Users; T1620 Reflective Code Loading
Discovery
T1046 Network Service Discovery
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
T1090 Proxy; T1219.002 Remote Access Tools: Remote Desktop Software; T1572 Protocol Tunneling
Privilege Escalation
T1134 Access Token Manipulation
Persistence
T1136.001 Create Account: Local Account; T1505.003 Server Software Component: Web Shell
Impact
Affected products and versions in Q3 2026 Malware Campaigns Targeting Windows Database Servers
Remediation for Q3 2026 Malware Campaigns Targeting Windows Database Servers
Patches
- Apply the latest vendor security patches to MS-SQL, MySQL, IIS and Windows
Immediate actions
- Block the listed domains, IPs and payload URLs at the perimeter and DNS layer
- Hunt MS-SQL/MySQL hosts for the listed MD5 hashes, GotoHTTP, SoftEther, Cloudflared, Suo5 and VShell artifacts
- Audit local accounts for MSSQLSERVERS$, mssql$ and adminweb1$ and remove any that are unauthorized
- Reset credentials on any host where reg save of HKLM\SYSTEM or browser data theft is suspected
Workarounds
- Disable xp_cmdshell and unused database features
- Remove or restrict RDP access for newly created local accounts
Longer-term hardening
- Do not expose MS-SQL (1433) or MySQL (3306) directly to the internet; restrict with firewall or VPN
- Enforce strong, periodically rotated passwords and account lockout for database service accounts
- Monitor database service processes (sqlservr.exe, mysqld.exe) for child process creation such as cmd.exe and powershell.exe
- Deploy EDR and web shell monitoring on IIS web roots co-hosted with database servers
Weaknesses (CWE) in Q3 2026 Malware Campaigns Targeting Windows Database Servers
Timeline of Q3 2026 Malware Campaigns Targeting Windows Database Servers
- Start of the Q3 2026 reporting period covered by the ASEC statistical report on attacks against Windows MS-SQL and MySQL servers
- The July case study lists the same S3/Alibaba OSS payload URLs, microsftapiedge.com domains and IPs 159.223.46.140 and 38.60.253.35 that the Q3 report later repeats, with two MD5 hashes (056ffa80... and 0eb0f57a...) shared and a Cloudflare R2 payload URL (gojoke.png, xmr-1.zip, qd_c_joke1.2.ps1) added
- ASEC publishes a case study of a targeted MS-SQL attack by Larva-26009 using GotoHTTP, SoftEther VPN, VShell, web shells, potato privilege-escalation tools and XMRig
- End of the Q3 2026 reporting period
- ASEC publishes the Q3 2026 statistical report naming XMRig, GotoHTTP, SoftEther, Sharp4WebCmd, Suo5, VShell, HackBrowserData, Fscan, Cloudflared and RingQ with IOCs
- Threadlinqs research compiled the Q3 report and July case study; BeaconBeagle returned no C2 correlations for the listed IPs and domain
Sources cited for Q3 2026 Malware Campaigns Targeting Windows Database Servers
- Q3 2026 Statistical Report on Malware Targeting Windows Database Servers (AhnLab ASEC)
- Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN (AhnLab ASEC)
- ASEC tag archive: GotoHTTP
- ASEC tag archive: SoftEther VPN
- ASEC tag archive: MS-SQL
- Case study mirror (hendryadrian.com)
Detection coverage for TL-2026-3451
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3451 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.