# Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners

> An active campaign observed since early October 2026 scans for Internet-facing Microsoft SQL Server instances (TCP 1433) with an embedded Naabu scanner and brute-forces accounts such as sa and admin. After login it uses T-SQL to enable xp_cmdshell and deploy a downloader, an XMRig Monero miner and a Themida-protected Gh0st RAT variant. No threat actor is named.

- **Published:** 2026-11-13T21:08:09Z
- **Last reviewed:** 2026-11-13T21:08:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5998
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5998.png
- **ID:** TL-2026-5998
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

FortiGuard Labs (Xiaopeng Zhang, published 2026-11-12) documented a multi-stage campaign against Internet-facing Microsoft SQL Server instances, first seen in early October 2026. The chain begins with dllhost.exe, a UPX-packed Go binary embedding the open-source Naabu v2 port scanner. It requests a target address from hxxp://site.vietnam852.com:88/ip.php, converts it to a hardcoded /16 CIDR block, sends TCP SYN probes to port 1433 and logs responsive hosts as '{IP} 1433 Open' in %temp%\Result.txt, then requests a new range.

Go.vbs launches go.bat, which uses findstr.exe to pick open hosts and starts dwm.exe, a .NET brute-forcer (assembly name CSQL.exe) that runs with up to 500 threads against accounts in user.txt (for example sa and admin) and more than 2,700 passwords in pass.txt, with output written to out.txt. Components (2018.sql, dwm.exe, go.bat, go.vbs, out.bat, sqlcmd.exe, user.txt, pass.txt) are staged from hxxp://site.vietnam852.com:88/2026/.

On a successful login a second dwm.exe instance executes 2018.sql in GO-separated batches. The script enables xp_cmdshell, downloads down.exe into C:\Users\Public and renames it to Google.exe or payload.exe, creates a daily scheduled task named Microsoft_UPDATES, and extracts an embedded executable from the @DATA variable to Secs.exe, which is copied to the Startup folder. Secs.exe is a downloader that pulls files from ftp.vietnam852.com with FtpGetFileW(), runs them with ShellExecuteW(), and registers the host (public IP, country, Windows edition, CPU/RAM, install time, user and host name) with an HTTP POST to post.php.

Two payloads follow. MicrosoftEdgeUpdate.exe is an XMRig Monero miner protected by Themida and a custom LZSS packer; it mines to xmr-ru.kryptex.network (port 7029 seen in the reporting request) with a hardcoded wallet and three pool URLs, and reports status with HTTP GET to /tj/xmr.php using the User-Agent 'XMRig Reporter'. winlogon.exe is a Themida-protected Gh0st RAT variant with hardcoded C2 server.vietnam852.com:8000 and www.swordaa.com:8000. It provides 30+ commands (keylogging, file management, remote shell, download-and-execute, in-memory execution, event-log wiping, process/service/registry managers), fingerprints the host and enumerates 78 security-product process names (such as MsMpEng.exe, avp.exe, 360tray.exe), and steals QQ data from \Tencent\Users. Screen capture and remote desktop are plugin-based. The RAT persists through an HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key, a Windows service and a scheduled task every 30 minutes. The C2 servers were already offline during analysis, so the RAT was analyzed statically only.

Persistence also uses scheduled tasks that imitate Microsoft Edge Update: MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} (every 30 minutes, runs E:\dllhost.exe) and MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159} (daily at 01:00, runs C:\Users\Public\Secs.exe). Additional hosting paths (/test/ on site.jiancai008.com and ftp.vietnam852.com) serve dllhost.exe, winlogon.exe, MicrosoftEdgeUpdate.exe, WinRing0x64.sys and sihost.exe; the sources do not describe the role of WinRing0x64.sys or sihost.exe beyond their appearance in the IOC list. FortiGuard does not name an actor, and the sources give no attribution. No CVE is involved: access relies on weak credentials on exposed servers. The sources give no full IP addresses; the target range is shown only as XXX.138.0.0/16.

## MITRE ATT&CK

- T1046 Network Service Discovery
- T1110.001 Brute Force: Password Guessing
- T1078.001 Valid Accounts: Default Accounts
- T1505.001 Server Software Component: SQL Stored Procedures
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1071.001 Application Layer Protocol: Web Protocols
- T1071.002 Application Layer Protocol: File Transfer Protocols
- T1571 Non-Standard Port
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1027.002 Obfuscated Files or Information: Software Packing
- T1685.005 Clear Windows Event Logs
- T1496 Resource Hijacking
- T1518.001 Software Discovery: Security Software Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1056.001 Input Capture: Keylogging
- T1005 Data from Local System
- T1113 Screen Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Gh0st RAT, Staging and FTP Domain Contact — C2 Phase** (`TL-2026-5998-SPL-003`)

Detects Sysmon network connections or DNS queries to the TL-2026-5998 infrastructure: server.vietnam852.com and www.swordaa.com (Gh0st RAT C2 on port 8000), site/ftp.vietnam852.com and site.jiancai008.com (port 88 staging, FtpGetFileW downloads, post.php registration) and site.hfgjjkrewjk.com.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1071.002, T1571
- **Data sources:** sysmon, dns_logs, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=3 OR EventCode=22)
```TL-2026-5998: Gh0st RAT C2 server.vietnam852.com:8000 and www.swordaa.com:8000, staging site.vietnam852.com:88, ftp.vietnam852.com```
| eval indicator=lower(coalesce(DestinationHostname, QueryName))
| where match(indicator,"(^|[.])(vietnam852[.]com|swordaa[.]com|jiancai008[.]com|hfgjjkrewjk[.]com)$")
| stats count values(indicator) as indicators values(DestinationPort) as ports values(Image) as processes min(_time) as first_seen max(_time) as last_seen by host, User
| convert ctime(first_seen) ctime(last_seen)
| eval threat_id="TL-2026-5998", technique="T1071.001"
````

### Microsoft KQL

```kql
let c2_domains = dynamic(["vietnam852.com", "swordaa.com", "jiancai008.com", "hfgjjkrewjk.com"]);
union
(DeviceNetworkEvents
 | where Timestamp > ago(24h)
 | where RemoteUrl has_any (c2_domains)
 | project TimeGenerated = Timestamp, Device = DeviceName, Process = InitiatingProcessFileName, ProcessPath = InitiatingProcessFolderPath, Indicator = RemoteUrl, RemoteIP, RemotePort, Source = "MDE-Network"),
(DnsEvents
 | where TimeGenerated > ago(24h)
 | where Name has_any (c2_domains)
 | project TimeGenerated, Device = Computer, Process = "", ProcessPath = "", Indicator = Name, RemoteIP = tostring(IPAddresses), RemotePort = int(null), Source = "DNS")
| order by TimeGenerated desc
```

### Sigma

```yaml
title: Connection to Gh0st RAT and Staging Domains - TL-2026-5998
id: 5e7d2b90-3a16-4c45-a8f3-1b6c9d04e707
status: experimental
description: Detects network connections to vietnam852.com, swordaa.com, jiancai008.com and hfgjjkrewjk.com. TL-2026-5998 uses server.vietnam852.com on port 8000 and www.swordaa.com on port 8000 for Gh0st RAT C2, and site/ftp hosts on port 88 for staging, FTP download and post.php registration.
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1071.002
    - attack.t1571
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|endswith:
            - '.vietnam852.com'
            - '.swordaa.com'
            - '.jiancai008.com'
            - '.hfgjjkrewjk.com'
    condition: selection_domain
falsepositives:
    - Threat-intel sandboxes or researchers resolving the domains
    - Security tools that test blocklisted domains
level: high

```

**Known false positives:**

- Threat-intel researchers or sandboxes resolving the domains
- Blocklist-testing tools

**Tuning notes:** The C2 servers were offline at analysis time, so a hit often shows a dormant implant or a staging attempt. Treat any hit from a SQL Server, or from winlogon.exe or dllhost.exe outside System32, as compromise. Add new indicators as intel is updated.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MSSQL Brute Force Against sa/admin Logins — Exploitation Phase (locked: unlock with TL Creds)
- SQL Server Spawning Shells and Download Tools via xp_cmdshell — Post-Exploitation (locked: unlock with TL Creds)
- XMRig Miner Pool Contact and Fake Edge Update Beacon — Impact (locked: unlock with TL Creds)
- Fake dllhost.exe Naabu Scanner and go.vbs/go.bat Launchers — Exploitation Phase (locked: unlock with TL Creds)
- Campaign Payloads Dropped in Public and Startup Folders — Post-Exploitation (locked: unlock with TL Creds)
- Fake winlogon.exe Gh0st RAT Run Key and Service Persistence — C2 Phase (locked: unlock with TL Creds)
- MSSQL xp_cmdshell Enabled via sp_configure — Exploitation Phase (locked: unlock with TL Creds)
- Edge Update Masquerading Scheduled Task Creation — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- Domain: `site[.]vietnam852[.]com`
- File hash: `8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D`
- Domain: `ftp[.]vietnam852[.]com`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners (GBHackers)](https://gbhackers.com/microsoft-sql-servers-hijacked/)
- [T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers (FortiGuard Labs)](https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers)
- [Gh0stCringe RAT makes database servers squeal for protection (Malwarebytes, related prior Gh0st-based SQL Server activity)](https://www.malwarebytes.com/blog/news/2022/03/gh0stcringe-rat-makes-database-servers-squeal-for-protection)
- [MITRE ATT&CK T1505.001 Server Software Component: SQL Stored Procedures](https://attack.mitre.org/techniques/T1505/001/)
- [MITRE ATT&CK T1053.005 Scheduled Task/Job: Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [ProjectDiscovery Naabu (open-source port scanner embedded in dllhost.exe)](https://github.com/projectdiscovery/naabu)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5998