Threat reportMalwareTL-2026-5864

T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers

highACTIVE

FortiGuard Labs reports a campaign that scans for TCP 1433 with a Go-based Naabu scanner, brute-forces MS SQL credentials with a .NET tool (CSQL), and runs a malicious T-SQL script (2018.sql) that enables xp_cmdshell and drops a loader. The loader fetches an XMRig-based Monero miner and a Gh0st RAT variant.

Key facts

Identifiers	TL-2026-5864
Severity	HIGH
First disclosed	2026-11-12
Affected products	Microsoft SQL Server (internet-exposed TCP 1433 with weak credentials)
Weaknesses (CWE)	CWE-521
Malware	Ghost RAT, xmrig
Tools	Naabu
MITRE ATT&CK techniques	T1012 Query Registry, T1027.002 Obfuscated Files or Information: Software Packing, T1036.005 Match Legitimate Resource Name or Location, T1046 Network Service Discovery, T1053.005 Scheduled Task/Job: Scheduled Task, T1056.001 Input Capture: Keylogging, T1057 Process Discovery, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1059.005 Command and Scripting Interpreter: Visual Basic, T1071.001 Application Layer Protocol: Web Protocols, T1071.002 Application Layer Protocol: File Transfer Protocols, T1082 System Information Discovery and 10 more in the attack flow
Motivation	FINANCIAL
Detection rules	9 (1 shown free)
Sources	6 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5864 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Masquerading Scheduled Tasks Microsoft_UPDATES and MicrosoftEdgeUpdateTaskMachine (TL-2026-5864)

Detects creation of scheduled tasks (Security 4698) named Microsoft_UPDATES, the two campaign GUID-named tasks MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-...} (dllhost.exe every 30 minutes) and MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-...} (Secs.exe daily at 01:00), and any MicrosoftEdgeUpdateTaskMachine task whose action is not under Program Files. Maps to T1053.005 and T1036.005.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1053.005, T1036.005
Data sources: wineventlog:security (4698), Sentinel SecurityEvent table, Sigma windows security
Severity: high
Confidence: high

Splunk SPL

```Masquerading persistence tasks from TL-2026-5864 (T1053.005, T1036.005)```
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 earliest=-24h
| eval task_name=coalesce(Task_Name,TaskName), task_xml=coalesce(Task_Content,TaskContent)
| where match(task_name,"(?i)Microsoft_UPDATES|CEC15D9B-F4BB-446A-B6E1-C61E74B016A2|4C33CE3F-7722-4257-AF83-351A4911C159") OR (match(task_name,"(?i)MicrosoftEdgeUpdateTaskMachine") AND NOT match(task_xml,"(?i)Program Files"))
| table _time host Account_Name task_name task_xml

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4698
| where EventData has "Microsoft_UPDATES"
    or EventData has "CEC15D9B-F4BB-446A-B6E1-C61E74B016A2"
    or EventData has "4C33CE3F-7722-4257-AF83-351A4911C159"
    or (EventData has "MicrosoftEdgeUpdateTaskMachine" and not(EventData contains "Program Files"))
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, EventData

Sigma

title: Masquerading Scheduled Task Used by T-SQL XMRig and Gh0st RAT Campaign
id: c7096b1e-34a8-4e72-8d5f-92b1a6e04c37
status: experimental
description: Detects scheduled tasks named Microsoft_UPDATES or the campaign MicrosoftEdgeUpdateTaskMachine GUID tasks, and Edge-update-named tasks whose action is outside Program Files, as created by 2018.sql, dllhost.exe and Secs.exe in TL-2026-5864.
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: windows
    service: security
    definition: Requires audit policy Audit Other Object Access Events (event 4698)
detection:
    selection_campaign:
        EventID: 4698
        TaskName|contains:
            - 'Microsoft_UPDATES'
            - 'CEC15D9B-F4BB-446A-B6E1-C61E74B016A2'
            - '4C33CE3F-7722-4257-AF83-351A4911C159'
    selection_masquerade:
        EventID: 4698
        TaskName|contains: 'MicrosoftEdgeUpdateTaskMachine'
    filter_legit_edge:
        TaskContent|contains: 'Program Files'
    condition: selection_campaign or (selection_masquerade and not filter_legit_edge)
falsepositives:
    - Legitimate Microsoft Edge updater tasks installed outside Program Files by unusual deployment tooling
level: high

Known false positives:

Genuine Edge updater task registered with a non-standard install path by enterprise packaging
Administrators creating test tasks named Microsoft_UPDATES

Tuning notes: Enable Audit Other Object Access Events so 4698 is generated. Add your own packaging path to the Program Files exclusion if Edge is deployed elsewhere. The two GUIDs and Microsoft_UPDATES are campaign-specific and should be treated as high fidelity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

SQL Server xp_cmdshell Enabled via sp_configure (2018.sql) - TL-2026-5864 · unlock with TL Creds
Masqueraded System Binaries and Known Campaign Hashes Executing (TL-2026-5864) · unlock with TL Creds
Masqueraded Process Network Activity to 1433/88/8000 or Campaign Domains (TL-2026-5864) · unlock with TL Creds
sqlservr.exe Spawning Shells, Downloaders or go.vbs/go.bat Launchers (TL-2026-5864) · unlock with TL Creds
Gh0st RAT and Loader Persistence via HKLM Run Key or Service ImagePath (TL-2026-5864) · unlock with TL Creds
DNS Lookups for Campaign C2/Staging Domains and Kryptex Mining Pool (TL-2026-5864) · unlock with TL Creds
MSSQL Password-Guessing Burst Against sa/admin (CSQL Brute Forcer) - TL-2026-5864 · unlock with TL Creds
XMRig Reporter Beacon and Campaign Domains in Web Traffic (TL-2026-5864) · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 43 indicators of compromise for TL-2026-5864.

Sample indicators (3 of 43)

Domain: site[.]vietnam852[.]com
File hash: 8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d
Domain: ftp[.]vietnam852[.]com

Defanged, TLP:CLEAR. Full set of 43 indicators: unlock with TL Creds.

43 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

No CVE or actor attribution is stated.

FortiGuard Labs discovered in early October 2026 a campaign that compromises internet-exposed Microsoft SQL Server instances through credential brute forcing and then abuses T-SQL and xp_cmdshell to deliver cryptomining and remote-access malware. The report was published on 2026-11-12. No CVE is involved; initial access relies on weak or guessable SQL logins (sa, admin).

The chain starts with dllhost.exe, a Go binary packed with UPX (3.9-5.21 detected) that embeds the open-source Naabu v2 scanner (TCP SYN scanning). It requests a target IP range from the attacker server (ip.php), converts it to CIDR notation with a hardcoded /16 mask (0x10), scans TCP 1433, and logs hits to %temp%\Result.txt. It persists with a scheduled task named to mimic Microsoft Edge (MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2}) that runs every 30 minutes. Supporting files are pulled into %Temp%: 2018.sql, dwm.exe, go.bat, go.vbs, out.bat, user.txt, pass.txt and sqlcmd.exe. go.vbs (run via cscript.exe) launches go.bat and out.bat; go.bat uses findstr to check Result.txt for ' Open,' and then starts dwm.exe.

dwm.exe is a .NET brute-force tool whose assembly name is CSQL.exe. It takes -i (targets), -u (usernames such as sa and admin), -p (password file with 2,700+ entries), -t (threads; 500 observed), -o (output) and -q (T-SQL file). After a successful login it launches another instance that executes 2018.sql on the victim server. The T-SQL script runs in GO-separated batches, enables xp_cmdshell, downloads an executable (via HTTP down.exe or FTP) to C:\Users\Public, renames it Google.exe or payload.exe and runs it, creates a daily scheduled task named Microsoft_UPDATES, and extracts an embedded EXE (the @DATA variable) to C:\Users\Public\Secs.exe, which it also copies to the Startup folder.

Secs.exe is the stage-two loader. It downloads files one at a time from the attacker FTP server to %Temp% and runs each with ShellExecuteW, creates a daily scheduled task (MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}) that runs Secs.exe at 01:00, and POSTs host information (public IP, country, Windows edition, CPU and RAM, OS install time, user and host names) to the backend. It delivers MicrosoftEdgeUpdate.exe, an XMRig-based Monero miner packed with Themida and a custom LZSS packer, alongside WinRing0x64.sys and sihost.exe staged on the same servers. The config holds a wallet and three pool URLs; one observed pool is xmr-ru.kryptex.network:7029. The miner reports status with a GET to /tj/xmr.php using an 'XMRig Reporter' User-Agent. It also delivers winlogon.exe, a Themida-packed Gh0st RAT variant. Its C2 (server.vietnam852.com:8000 and www.swordaa.com:8000) was offline during analysis, so only static analysis was done. It persists via an HKLM Run key, a Windows service and a 30-minute schtasks job. It offers a remote shell, file manager, upload/download and execute, in-memory execution, keylogging, event-log wiping, process/service/registry management, host fingerprinting, enumeration of security products (78 process names, e.g. 360tray.exe, MsMpEng.exe, avp.exe) and QQ data theft, with screen capture and remote desktop as plugins and more than 30 control commands.

The source article does not state victim regions or sectors, and it gives no attribution.

MITRE ATT&CK techniques by tactic:

Remediation

Immediate actions

Block the campaign domains (vietnam852.com, swordaa.com, hfgjjkrewjk.com, jiancai008.com) and associated URLs at the perimeter
Hunt SQL Server hosts for 2018.sql, Secs.exe, dwm.exe, dllhost.exe, winlogon.exe, sihost.exe, WinRing0x64.sys and MicrosoftEdgeUpdate.exe outside their legitimate paths, especially in C:\Users\Public and %Temp%
Check for rogue scheduled tasks Microsoft_UPDATES, MicrosoftEdgeUpdateTaskMachineUA{...} and MicrosoftEdgeUpdateTaskMachineCore{...}, and for unexpected HKLM Run keys and Windows services
Rotate sa/admin and other SQL logins on any server showing brute-force activity and review for xp_cmdshell being enabled

Workarounds

Apply account lockout or login-failure alerting for SQL Server authentication
Use Fortinet IPS signature MS.SQL.Server.Brute.Force.Login and AV signatures W64/MSSQLBruteforcer.F62C!tr, W64/Agent.DRN!tr, W32/Agent.DAV!tr, VBS/Agent.PPWT!tr and MSIL/Agent.AFL!tr where available

Longer-term hardening

Do not expose TCP 1433 to the internet; restrict access by firewall or VPN
Enforce strong, unique SQL credentials and disable or rename the sa account
Keep xp_cmdshell disabled and alert on sp_configure changes that enable it
Monitor for outbound HTTP/FTP downloads and process spawning from sqlservr.exe

Affected and fixed versions

Microsoft — SQL Server (internet-exposed TCP 1433 with weak credentials)
Vulnerable versions: Instances with weak or guessable sa/admin credentials reachable on TCP 1433

Timeline

2026-10-01 The Gh0st RAT (winlogon.exe) C2 servers had already shut down before analysis, so only static analysis of the sample was possible (date approximated; the article gives no exact day).
2026-10-01 FortiGuard analyzes the dllhost.exe/Naabu scanner, dwm.exe (CSQL.exe) brute forcer and 2018.sql T-SQL script (date approximated to early October 2026).
2026-10-01 FortiGuard Labs discovers the campaign in early October 2026 (exact day not stated; date approximated to the start of the month).
2026-11-12 Threadlinqs opens tracking for the campaign (no CVE, no attribution, no victim sectors or regions stated in the source).
2026-11-12 Domains, URLs and SHA-256 hashes for the scanner, brute forcer, SQL script, loader, XMRig miner and Gh0st RAT variant are published in the report.
2026-11-12 Fortinet reports coverage: Web Filtering for campaign domains/URLs, AV signatures (W64/MSSQLBruteforcer.F62C!tr, W64/Agent.DRN!tr, W32/Agent.DAV!tr, VBS/Agent.PPWT!tr, MSIL/Agent.AFL!tr), IPS MS.SQL.Server.Brute.Force.Login and FortiGate tcp_port_scan DoS policy.
2026-11-12 Fortinet publishes 'T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers' with IOCs and MITRE mappings.

Sources cited

T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers Fortinet · Research · 2026-11-12
MITRE ATT&CK - Gh0st RAT (S0032) MITRE · Research
MITRE ATT&CK - T1505.001 SQL Stored Procedures MITRE · Research
MITRE ATT&CK - T1496.001 Compute Hijacking MITRE · Research
ProjectDiscovery Naabu (port scanner) GitHub · Code repository
XMRig Monero miner GitHub · Code repository

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 6 sources; published 2026-11-12; last updated —. Reviewed 2026-11-12.

T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers

Key facts

Detection coverage

Free detection: Masquerading Scheduled Tasks Microsoft_UPDATES and MicrosoftEdgeUpdateTaskMachine (TL-2026-5864)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 43)

Technical analysis

Discovery

Defense Evasion

Persistence

Collection

Execution

Command and Control

Credential Access

defense-impairment

Impact

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

Previous and next in malware

Latest Threats

🔄 Threat Comparison

T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers

Key facts

Detection coverage

Free detection: Masquerading Scheduled Tasks Microsoft_UPDATES and MicrosoftEdgeUpdateTaskMachine (TL-2026-5864)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (3 of 43)

Technical analysis

Discovery

Defense Evasion

Persistence

Collection

Execution

Command and Control

Credential Access

defense-impairment

Impact

Remediation

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

More in malware

Previous and next in malware

Latest Threats

🔄 Threat Comparison