[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxLe2o_Fy-EMs4_PEmo3xPv0FyxLsBTaL32frsGeFKNk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"f2ba042d-c8be-4889-a9c7-2c744dee6878","weak-sql-server-credentials-open-door-to-miners-and-rat","bf1aec8d-9394-4877-8ed2-0086c5b7f5df","Weak SQL Server Credentials Open Door to Miners and RAT","Attackers successfully compromised internet-exposed Microsoft SQL Server instances by simply guessing weak passwords — no software vulnerability was needed. Once inside, they abused built-in database features to drop a Monero cryptocurrency miner and Gh0st RAT, gaining persistent remote access to the underlying Windows host. This attack illustrates how a single weak credential on an internet-facing service can hand attackers full control of a system. Exposing database servers directly to the internet with default or trivial passwords remains one of the most preventable yet persistently exploited misconfigurations in enterprise environments.","**Immediate actions:**\n- Enforce strong, unique passwords on all SQL Server accounts and disable or rename the default 'sa' (system administrator) account immediately.\n- Remove Microsoft SQL Server from direct internet exposure by placing it behind a firewall or VPN, allowing only necessary internal hosts to connect.\n- Audit all SQL Server logins and disable any accounts that are unused or have not been recently reviewed.\n\n**Long-term improvements:**\n- Implement a privileged access management (PAM) solution to centrally govern and rotate database credentials automatically.\n- Harden SQL Server configurations by disabling dangerous features (e.g., xp_cmdshell) that allow operating system command execution from within the database.\n- Maintain an asset inventory of all internet-facing services and subject them to regular attack-surface reviews.\n\n**Detection measures:**\n- Enable SQL Server audit logging and ship logs to a SIEM to alert on repeated failed login attempts and unusual stored procedure executions.\n- Deploy network-based monitoring to detect anomalous outbound traffic patterns consistent with cryptocurrency mining (high CPU, mining pool connections) or RAT command-and-control beaconing.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(i)","MITRE ATT&CK T1110: Brute Force",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1110: Brute Force":19,"CIS Control 6: Access Control Management":20,"NIST SP 800-53 IA-5: Authenticator Management":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":22},"This point covers access control and asset management, requiring organisations to enforce appropriate authentication controls on critical systems like internet-facing database servers.","The attackers used password-guessing (a brute-force technique) against SQL Server authentication as their sole method of initial access, making this technique directly applicable to the incident.","This control requires enforcing strong credentials and least-privilege access; had SQL Server accounts been subject to these requirements, password-guessing attacks would have been far less likely to succeed.","IA-5 mandates minimum password complexity and prohibits easily guessable credentials, directly addressing the weak SQL Server passwords that allowed attackers to gain initial access.","This control requires hardening default configurations — including disabling dangerous features like xp_cmdshell and renaming default accounts — which would have removed the database-level capabilities attackers used to execute OS commands.","published","2026-11-12T17:21:13.893557+00:00","2026-11-12T17:21:13.877+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhackread.com\u002Fhackers-abuse-microsoft-sql-servers-monero-miner-gh0st-rat\u002F","hackers-abuse-microsoft-sql-servers-to-deploy-monero-miner-and-gh0st-rat-20a0e5","Hackers Abuse Microsoft SQL Servers to Deploy Monero Miner and Gh0st RAT",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]