FortiGuard Labs Reports Hackers Hijacked Microsoft SQL Servers to Deploy Gh0st RAT and Monero Miners

According to ChainCatcher citing Crypto Briefing, FortiGuard Labs disclosed an attack campaign targeting Microsoft SQL Server databases exposed to the internet. Attackers used weak passwords and misconfigurations to break into servers through brute-force attacks, then enabled xp_cmdshell to install two malicious payloads: a Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant capable of keylogging and taking screenshots. Both payloads established persistence by modifying the registry and creating scheduled tasks. FortiGuard Labs said the campaign has been active since at least early October 2026. The number of victims has not been confirmed, and the attack has not been attributed to a specific actor.