# Q3 2026 Malware Campaigns Targeting Windows Database Servers (MS-SQL/MySQL) - XMRig, Web Shells, VShell, Remote Access Tools

> AhnLab ASEC's Q3 2026 report describes attacks on Windows MS-SQL and MySQL servers that begin with brute-force/dictionary attacks or poor account management and lead to payload download, web shell persistence, credential theft, internal scanning, and XMRig/SoftEther VPN deployment. The IOCs overlap with a July 2026 ASEC case study attributed to Larva-26009. No CVE is cited.

- **Published:** 2026-10-14T02:25:02Z
- **Last reviewed:** 2026-10-14T02:25:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3451
- **ID:** TL-2026-3451
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Larva-26009
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab Security Intelligence Center (ASEC) published its Q3 2026 statistical report on malware targeting Windows database servers on 2026-10-08. The report covers MS-SQL and MySQL servers on Windows that are exposed to the internet and poorly managed. Initial access is described as brute-force and dictionary attacks combined with improper account management, plus exploitation of vulnerabilities. Once the attacker can run commands through the database server, they download additional payloads.

The tools named in the report are XMRig (Monero CoinMiner), GotoHTTP (remote access backdoor, executed in memory), SoftEther VPN (operated in Cascade Connection mode as C&C/tunnel infrastructure), Sharp4WebCmd and Suo5 (ASPX web shells; Suo5 provides tunneling), a PowerShell web shell that authenticates with the username 'joke', VShell (Go-based backdoor with remote execution and file management), HackBrowserData (browser credential stealer), Fscan (internal network scanner), Cloudflared (exposes local ports through a tunnel) and RingQ (encrypted file execution). Credential theft included 'reg save HKLM\SYSTEM' commands. Persistent RDP access was set up through backdoor accounts named MSSQLSERVERS$ and mssql$.

A related ASEC case study published 2026-07-25 attributes a targeted MS-SQL intrusion to the actor Larva-26009. It shares the same payload URLs, domains, IPs and several hashes with the Q3 report. That case study adds privilege-escalation tools (JuicyPotatoNG, SigmaPotato, BadPotato, RustPotato), Chrome Remote Desktop, a Mimikatz VShell plugin, a third backdoor account (adminweb1$), and a payload URL on Cloudflare R2. The Q3 report itself gives no attribution, so the actor link rests on IOC overlap and carries low confidence for the Q3 activity as a whole. Severity is an analyst assessment, since no CVE or CVSS is given. Network IOCs were checked against BeaconBeagle: the beacon lookups for both IPs returned HTTP 404 and the config search for microsftapiedge.com returned zero results, so there are no C2 correlations.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1078 Valid Accounts
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1021.001 Remote Services: Remote Desktop Protocol
- T1219.002 Remote Access Tools: Remote Desktop Software
- T1572 Protocol Tunneling
- T1003.002 OS Credential Dumping: Security Account Manager
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1046 Network Service Discovery
- T1620 Reflective Code Loading
- T1496.001 Resource Hijacking: Compute Hijacking
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1564.002 Hide Artifacts: Hidden Users
- T1197 BITS Jobs
- T1027 Obfuscated Files or Information
- T1134 Access Token Manipulation
- T1090 Proxy

## Sources

- [Q3 2026 Statistical Report on Malware Targeting Windows Database Servers (AhnLab ASEC)](https://asec.ahnlab.com/en/95809/)
- [Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN (AhnLab ASEC)](https://asec.ahnlab.com/en/94685/)
- [ASEC tag archive: GotoHTTP](https://asec.ahnlab.com/en/tag/gotohttp-en/)
- [ASEC tag archive: SoftEther VPN](https://asec.ahnlab.com/en/tag/softethervpn-en/)
- [ASEC tag archive: MS-SQL](https://asec.ahnlab.com/en/tag/ms-sql-en/)
- [Case study mirror (hendryadrian.com)](https://www.hendryadrian.com/?p=108415)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3451