Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5998 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gh0st RAT, Staging and FTP Domain Contact — C2 Phase

Detects Sysmon network connections or DNS queries to the TL-2026-5998 infrastructure: server.vietnam852.com and www.swordaa.com (Gh0st RAT C2 on port 8000), site/ftp.vietnam852.com and site.jiancai008.com (port 88 staging, FtpGetFileW downloads, post.php registration) and site.hfgjjkrewjk.com.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1071.002, T1571
• Data sources: sysmon, dns_logs, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=3 OR EventCode=22)
```TL-2026-5998: Gh0st RAT C2 server.vietnam852.com:8000 and www.swordaa.com:8000, staging site.vietnam852.com:88, ftp.vietnam852.com```
| eval indicator=lower(coalesce(DestinationHostname, QueryName))
| where match(indicator,"(^|[.])(vietnam852[.]com|swordaa[.]com|jiancai008[.]com|hfgjjkrewjk[.]com)$")
| stats count values(indicator) as indicators values(DestinationPort) as ports values(Image) as processes min(_time) as first_seen max(_time) as last_seen by host, User
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5998", technique="T1071.001"

Microsoft KQL

let c2_domains = dynamic(["vietnam852.com", "swordaa.com", "jiancai008.com", "hfgjjkrewjk.com"]);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl has_any (c2_domains)
 | project TimeGenerated = Timestamp, Device = DeviceName, Process = InitiatingProcessFileName, ProcessPath = InitiatingProcessFolderPath, Indicator = RemoteUrl, RemoteIP, RemotePort, Source = "MDE-Network"),
(DnsEvents
 | where TimeGenerated > ago(24h)
 | where Name has_any (c2_domains)
 | project TimeGenerated, Device = Computer, Process = "", ProcessPath = "", Indicator = Name, RemoteIP = tostring(IPAddresses), RemotePort = int(null), Source = "DNS")
| order by TimeGenerated desc

Sigma

title: Connection to Gh0st RAT and Staging Domains - TL-2026-5998
id: 5e7d2b90-3a16-4c45-a8f3-1b6c9d04e707
status: experimental
description: Detects network connections to vietnam852.com, swordaa.com, jiancai008.com and hfgjjkrewjk.com. TL-2026-5998 uses server.vietnam852.com on port 8000 and www.swordaa.com on port 8000 for Gh0st RAT C2, and site/ftp hosts on port 88 for staging, FTP download and post.php registration.
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1071.002
    - attack.t1571
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|endswith:
            - '.vietnam852.com'
            - '.swordaa.com'
            - '.jiancai008.com'
            - '.hfgjjkrewjk.com'
    condition: selection_domain
falsepositives:
    - Threat-intel sandboxes or researchers resolving the domains
    - Security tools that test blocklisted domains
level: high

Known false positives:

• Threat-intel researchers or sandboxes resolving the domains
• Blocklist-testing tools

Tuning notes: The C2 servers were offline at analysis time, so a hit often shows a dormant implant or a staging attempt. Treat any hit from a SQL Server, or from winlogon.exe or dllhost.exe outside System32, as compromise. Add new indicators as intel is updated.

• 🔒 MSSQL Brute Force Against sa/admin Logins — Exploitation Phase · unlock with TL Creds
• 🔒 SQL Server Spawning Shells and Download Tools via xp_cmdshell — Post-Exploitation · unlock with TL Creds
• 🔒 XMRig Miner Pool Contact and Fake Edge Update Beacon — Impact · unlock with TL Creds
• 🔒 Fake dllhost.exe Naabu Scanner and go.vbs/go.bat Launchers — Exploitation Phase · unlock with TL Creds
• 🔒 Campaign Payloads Dropped in Public and Startup Folders — Post-Exploitation · unlock with TL Creds
• 🔒 Fake winlogon.exe Gh0st RAT Run Key and Service Persistence — C2 Phase · unlock with TL Creds
• 🔒 MSSQL xp_cmdshell Enabled via sp_configure — Exploitation Phase · unlock with TL Creds
• 🔒 Edge Update Masquerading Scheduled Task Creation — Post-Exploitation · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-5998.

Sample indicators (3 of 31)

• Domain: site[.]vietnam852[.]com
• File hash: 8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D
• Domain: ftp[.]vietnam852[.]com

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Technical analysis

No threat actor is named.

FortiGuard Labs (Xiaopeng Zhang, published 2026-11-12) documented a multi-stage campaign against Internet-facing Microsoft SQL Server instances, first seen in early October 2026. The chain begins with dllhost.exe, a UPX-packed Go binary embedding the open-source Naabu v2 port scanner. It requests a target address from hxxp://site.vietnam852.com:88/ip.php, converts it to a hardcoded /16 CIDR block, sends TCP SYN probes to port 1433 and logs responsive hosts as '{IP} 1433 Open' in %temp%\Result.txt, then requests a new range.

Go.vbs launches go.bat, which uses findstr.exe to pick open hosts and starts dwm.exe, a .NET brute-forcer (assembly name CSQL.exe) that runs with up to 500 threads against accounts in user.txt (for example sa and admin) and more than 2,700 passwords in pass.txt, with output written to out.txt. Components (2018.sql, dwm.exe, go.bat, go.vbs, out.bat, sqlcmd.exe, user.txt, pass.txt) are staged from hxxp://site.vietnam852.com:88/2026/.

On a successful login a second dwm.exe instance executes 2018.sql in GO-separated batches. The script enables xp_cmdshell, downloads down.exe into C:\Users\Public and renames it to Google.exe or payload.exe, creates a daily scheduled task named Microsoft_UPDATES, and extracts an embedded executable from the @DATA variable to Secs.exe, which is copied to the Startup folder. Secs.exe is a downloader that pulls files from ftp.vietnam852.com with FtpGetFileW(), runs them with ShellExecuteW(), and registers the host (public IP, country, Windows edition, CPU/RAM, install time, user and host name) with an HTTP POST to post.php.

Two payloads follow. MicrosoftEdgeUpdate.exe is an XMRig Monero miner protected by Themida and a custom LZSS packer; it mines to xmr-ru.kryptex.network (port 7029 seen in the reporting request) with a hardcoded wallet and three pool URLs, and reports status with HTTP GET to /tj/xmr.php using the User-Agent 'XMRig Reporter'. winlogon.exe is a Themida-protected Gh0st RAT variant with hardcoded C2 server.vietnam852.com:8000 and www.swordaa.com:8000. It provides 30+ commands (keylogging, file management, remote shell, download-and-execute, in-memory execution, event-log wiping, process/service/registry managers), fingerprints the host and enumerates 78 security-product process names (such as MsMpEng.exe, avp.exe, 360tray.exe), and steals QQ data from \Tencent\Users. Screen capture and remote desktop are plugin-based. The RAT persists through an HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key, a Windows service and a scheduled task every 30 minutes. The C2 servers were already offline during analysis, so the RAT was analyzed statically only.

Persistence also uses scheduled tasks that imitate Microsoft Edge Update: MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} (every 30 minutes, runs E:\dllhost.exe) and MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159} (daily at 01:00, runs C:\Users\Public\Secs.exe). Additional hosting paths (/test/ on site.jiancai008.com and ftp.vietnam852.com) serve dllhost.exe, winlogon.exe, MicrosoftEdgeUpdate.exe, WinRing0x64.sys and sihost.exe; the sources do not describe the role of WinRing0x64.sys or sihost.exe beyond their appearance in the IOC list. FortiGuard does not name an actor, and the sources give no attribution. No CVE is involved: access relies on weak credentials on exposed servers. The sources give no full IP addresses; the target range is shown only as XXX.138.0.0/16.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1056.001 Input Capture: Keylogging; T1113 Screen Capture

Defense Evasion

T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Masquerading: Match Legitimate Resource Name or Location

Discovery

T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1505.001 Server Software Component: SQL Stored Procedures; T1543.003 Create or Modify System Process: Windows Service; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.005 Command and Scripting Interpreter: Visual Basic

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1071.002 Application Layer Protocol: File Transfer Protocols; T1571 Non-Standard Port

Initial Access

T1078.001 Valid Accounts: Default Accounts

Credential Access

T1110.001 Brute Force: Password Guessing

Impact

T1496 Resource Hijacking

defense-impairment

T1685.005 Clear Windows Event Logs

Remediation

Immediate actions

• Block outbound traffic to vietnam852.com, swordaa.com, hfgjjkrewjk.com, jiancai008.com and xmr-ru.kryptex.network
• Treat any SQL Server where xp_cmdshell was unexpectedly enabled as compromised and isolate it
• Hunt for Secs.exe, Google.exe, payload.exe, MicrosoftEdgeUpdate.exe and winlogon.exe in C:\Users\Public, the Startup folder and %Temp%
• Hunt for Edge-update scheduled tasks pointing to C:\Users\Public or non-standard drives such as E:, and for the Microsoft_UPDATES task
• Rotate sa and all SQL logins, and review the HKLM Run key and services for Gh0st RAT persistence

Workarounds

• Rename or disable the sa account
• Keep xp_cmdshell disabled
• Apply FortiGuard coverage: IPS MS.SQL.Server.Brute.Force.Login, AV signatures W64/MSSQLBruteforcer.F62C!tr, W64/Agent.DRN!tr, W32/Agent.DAV!tr, VBS/Agent.PPWT!tr, MSIL/Agent.AFL!tr, and tcp_port_scan in the FortiGate DoS policy

Longer-term hardening

• Never expose TCP 1433 to the Internet; restrict access by firewall, VPN or private networking
• Enforce long unique passwords with account lockout policies on SQL logins
• Monitor SQL Server for sp_configure changes enabling xp_cmdshell and for bursts of failed logins
• Alert on inbound TCP port scans and brute-force logins against SQL Server

Affected and fixed versions

• Microsoft — SQL Server (Internet-facing instances on TCP 1433 with weak credentials)
  Vulnerable versions: Instances exposed to the Internet with weak sa/admin credentials; no specific versions identified

Timeline

• 2022-03-01 Context: Malwarebytes published research on Gh0stCringe, a Gh0st RAT variant also deployed to Microsoft SQL and MySQL servers with weak protection, showing this server-targeting pattern predates the 2026 campaign (a related, not confirmed same-actor, campaign).
• 2026-10-01 Observed during the early-October activity: after successful logins 2018.sql enables xp_cmdshell and deploys the Secs.exe downloader, the XMRig miner (MicrosoftEdgeUpdate.exe) and the Gh0st RAT variant (winlogon.exe) with scheduled-task, Run key, service and Startup folder persistence (date approximate).
• 2026-10-01 FortiGuard Labs discovered the campaign in early October 2026: dllhost.exe (Go/Naabu) scanning TCP 1433 and the CSQL.exe brute-forcer targeting Internet-facing MSSQL servers (exact day not stated; 1 October used as the month marker).
• 2026-11-12 FortiGuard listed detection coverage: AV signatures (W64/MSSQLBruteforcer.F62C!tr and others), IPS MS.SQL.Server.Brute.Force.Login, web filtering of the C2 domains and URLs as malicious, and tcp_port_scan DoS-policy detection.
• 2026-11-12 FortiGuard Labs (Xiaopeng Zhang) published 'T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers' with IOCs and SHA-256 hashes.
• 2026-11-12 FortiGuard reported the Gh0st RAT C2 servers had already shut down before analysis, so winlogon.exe was analyzed statically only; payload files could still be downloaded from the staging hosts (publication date used as marker).
• 2026-11-13 GBHackers (Mayura Kathir) published a summary of the FortiGuard research with defensive recommendations (disable xp_cmdshell, do not expose port 1433, rename sa, hunt for Edge-update task masquerades).

Sources cited

• MITRE ATT&CK T1505.001 Server Software Component: SQL Stored Procedures MITRE · Advisory
• MITRE ATT&CK T1053.005 Scheduled Task/Job: Scheduled Task MITRE · Advisory
• T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers (FortiGuard Labs) Fortinet · Research · 2026-11-12
• ProjectDiscovery Naabu (open-source port scanner embedded in dllhost.exe) GitHub · Code repository
• Gh0stCringe RAT makes database servers squeal for protection (Malwarebytes, related prior Gh0st-based SQL Server activity) malwarebytes.com · Blog · 2022-03-01
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners (GBHackers) gbhackers.com · News · 2026-11-13

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines
• Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers