# T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers

> FortiGuard Labs reports a campaign that scans for TCP 1433 with a Go-based Naabu scanner, brute-forces MS SQL credentials with a .NET tool (CSQL), and runs a malicious T-SQL script (2018.sql) that enables xp_cmdshell and drops a loader. The loader fetches an XMRig-based Monero miner and a Gh0st RAT variant. No CVE or actor attribution is stated.

- **Published:** 2026-11-12T14:45:59Z
- **Last reviewed:** 2026-11-12T14:45:59Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5864
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5864.png
- **ID:** TL-2026-5864
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 43 (3 shown free below)

## Description

FortiGuard Labs discovered in early October 2026 a campaign that compromises internet-exposed Microsoft SQL Server instances through credential brute forcing and then abuses T-SQL and xp_cmdshell to deliver cryptomining and remote-access malware. The report was published on 2026-11-12. No CVE is involved; initial access relies on weak or guessable SQL logins (sa, admin).

The chain starts with dllhost.exe, a Go binary packed with UPX (3.9-5.21 detected) that embeds the open-source Naabu v2 scanner (TCP SYN scanning). It requests a target IP range from the attacker server (ip.php), converts it to CIDR notation with a hardcoded /16 mask (0x10), scans TCP 1433, and logs hits to %temp%\Result.txt. It persists with a scheduled task named to mimic Microsoft Edge (MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2}) that runs every 30 minutes. Supporting files are pulled into %Temp%: 2018.sql, dwm.exe, go.bat, go.vbs, out.bat, user.txt, pass.txt and sqlcmd.exe. go.vbs (run via cscript.exe) launches go.bat and out.bat; go.bat uses findstr to check Result.txt for ' Open,' and then starts dwm.exe.

dwm.exe is a .NET brute-force tool whose assembly name is CSQL.exe. It takes -i (targets), -u (usernames such as sa and admin), -p (password file with 2,700+ entries), -t (threads; 500 observed), -o (output) and -q (T-SQL file). After a successful login it launches another instance that executes 2018.sql on the victim server. The T-SQL script runs in GO-separated batches, enables xp_cmdshell, downloads an executable (via HTTP down.exe or FTP) to C:\Users\Public, renames it Google.exe or payload.exe and runs it, creates a daily scheduled task named Microsoft_UPDATES, and extracts an embedded EXE (the @DATA variable) to C:\Users\Public\Secs.exe, which it also copies to the Startup folder.

Secs.exe is the stage-two loader. It downloads files one at a time from the attacker FTP server to %Temp% and runs each with ShellExecuteW, creates a daily scheduled task (MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}) that runs Secs.exe at 01:00, and POSTs host information (public IP, country, Windows edition, CPU and RAM, OS install time, user and host names) to the backend. It delivers MicrosoftEdgeUpdate.exe, an XMRig-based Monero miner packed with Themida and a custom LZSS packer, alongside WinRing0x64.sys and sihost.exe staged on the same servers. The config holds a wallet and three pool URLs; one observed pool is xmr-ru.kryptex.network:7029. The miner reports status with a GET to /tj/xmr.php using an 'XMRig Reporter' User-Agent. It also delivers winlogon.exe, a Themida-packed Gh0st RAT variant. Its C2 (server.vietnam852.com:8000 and www.swordaa.com:8000) was offline during analysis, so only static analysis was done. It persists via an HKLM Run key, a Windows service and a 30-minute schtasks job. It offers a remote shell, file manager, upload/download and execute, in-memory execution, keylogging, event-log wiping, process/service/registry management, host fingerprinting, enumeration of security products (78 process names, e.g. 360tray.exe, MsMpEng.exe, avp.exe) and QQ data theft, with screen capture and remote desktop as plugins and more than 30 control commands.

The source article does not state victim regions or sectors, and it gives no attribution.

## MITRE ATT&CK

- T1046 Network Service Discovery
- T1110.001 Brute Force: Password Guessing
- T1505.001 Server Software Component: SQL Stored Procedures
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.002 Application Layer Protocol: File Transfer Protocols
- T1095 Non-Application Layer Protocol
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1027.002 Obfuscated Files or Information: Software Packing
- T1685.001 Disable or Modify Windows Event Log
- T1112 Modify Registry
- T1496.001 Resource Hijacking: Compute Hijacking
- T1057 Process Discovery
- T1082 System Information Discovery
- T1012 Query Registry
- T1518.001 Software Discovery: Security Software Discovery
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Masquerading Scheduled Tasks Microsoft_UPDATES and MicrosoftEdgeUpdateTaskMachine (TL-2026-5864)** (`TL-2026-5864-SPL-002`)

Detects creation of scheduled tasks (Security 4698) named Microsoft_UPDATES, the two campaign GUID-named tasks MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-...} (dllhost.exe every 30 minutes) and MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-...} (Secs.exe daily at 01:00), and any MicrosoftEdgeUpdateTaskMachine task whose action is not under Program Files. Maps to T1053.005 and T1036.005.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1036.005
- **Data sources:** wineventlog:security (4698), Sentinel SecurityEvent table, Sigma windows security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
```Masquerading persistence tasks from TL-2026-5864 (T1053.005, T1036.005)```
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 earliest=-24h
| eval task_name=coalesce(Task_Name,TaskName), task_xml=coalesce(Task_Content,TaskContent)
| where match(task_name,"(?i)Microsoft_UPDATES|CEC15D9B-F4BB-446A-B6E1-C61E74B016A2|4C33CE3F-7722-4257-AF83-351A4911C159") OR (match(task_name,"(?i)MicrosoftEdgeUpdateTaskMachine") AND NOT match(task_xml,"(?i)Program Files"))
| table _time host Account_Name task_name task_xml
````

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4698
| where EventData has "Microsoft_UPDATES"
    or EventData has "CEC15D9B-F4BB-446A-B6E1-C61E74B016A2"
    or EventData has "4C33CE3F-7722-4257-AF83-351A4911C159"
    or (EventData has "MicrosoftEdgeUpdateTaskMachine" and not(EventData contains "Program Files"))
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, EventData
```

### Sigma

```yaml
title: Masquerading Scheduled Task Used by T-SQL XMRig and Gh0st RAT Campaign
id: c7096b1e-34a8-4e72-8d5f-92b1a6e04c37
status: experimental
description: Detects scheduled tasks named Microsoft_UPDATES or the campaign MicrosoftEdgeUpdateTaskMachine GUID tasks, and Edge-update-named tasks whose action is outside Program Files, as created by 2018.sql, dllhost.exe and Secs.exe in TL-2026-5864.
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    product: windows
    service: security
    definition: Requires audit policy Audit Other Object Access Events (event 4698)
detection:
    selection_campaign:
        EventID: 4698
        TaskName|contains:
            - 'Microsoft_UPDATES'
            - 'CEC15D9B-F4BB-446A-B6E1-C61E74B016A2'
            - '4C33CE3F-7722-4257-AF83-351A4911C159'
    selection_masquerade:
        EventID: 4698
        TaskName|contains: 'MicrosoftEdgeUpdateTaskMachine'
    filter_legit_edge:
        TaskContent|contains: 'Program Files'
    condition: selection_campaign or (selection_masquerade and not filter_legit_edge)
falsepositives:
    - Legitimate Microsoft Edge updater tasks installed outside Program Files by unusual deployment tooling
level: high
```

**Known false positives:**

- Genuine Edge updater task registered with a non-standard install path by enterprise packaging
- Administrators creating test tasks named Microsoft_UPDATES

**Tuning notes:** Enable Audit Other Object Access Events so 4698 is generated. Add your own packaging path to the Program Files exclusion if Edge is deployed elsewhere. The two GUIDs and Microsoft_UPDATES are campaign-specific and should be treated as high fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SQL Server xp_cmdshell Enabled via sp_configure (2018.sql) - TL-2026-5864 (locked: unlock with TL Creds)
- Masqueraded System Binaries and Known Campaign Hashes Executing (TL-2026-5864) (locked: unlock with TL Creds)
- Masqueraded Process Network Activity to 1433/88/8000 or Campaign Domains (TL-2026-5864) (locked: unlock with TL Creds)
- sqlservr.exe Spawning Shells, Downloaders or go.vbs/go.bat Launchers (TL-2026-5864) (locked: unlock with TL Creds)
- Gh0st RAT and Loader Persistence via HKLM Run Key or Service ImagePath (TL-2026-5864) (locked: unlock with TL Creds)
- DNS Lookups for Campaign C2/Staging Domains and Kryptex Mining Pool (TL-2026-5864) (locked: unlock with TL Creds)
- MSSQL Password-Guessing Burst Against sa/admin (CSQL Brute Forcer) - TL-2026-5864 (locked: unlock with TL Creds)
- XMRig Reporter Beacon and Campaign Domains in Web Traffic (TL-2026-5864) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 43)

Defanged, TLP:CLEAR.

- Domain: `site[.]vietnam852[.]com`
- File hash: `8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d`
- Domain: `ftp[.]vietnam852[.]com`

Full set of 43 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers](https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers)
- [MITRE ATT&CK - Gh0st RAT (S0032)](https://attack.mitre.org/software/S0032/)
- [ProjectDiscovery Naabu (port scanner)](https://github.com/projectdiscovery/naabu)
- [XMRig Monero miner](https://github.com/xmrig/xmrig)
- [MITRE ATT&CK - T1505.001 SQL Stored Procedures](https://attack.mitre.org/techniques/T1505/001/)
- [MITRE ATT&CK - T1496.001 Compute Hijacking](https://attack.mitre.org/techniques/T1496/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5864