Monero miner and Gh0st RAT found on exposed SQL Servers

BitcoinWorld

Monero miner and Gh0st RAT found on exposed SQL Servers

FortiGuard Labs has tied a cryptojacking and remote-access campaign to internet-facing Microsoft SQL Servers, detailing the operation in a Nov. 12 report by researcher Xiaopeng Zhang after finding the activity in early October 2026, Crypto.news reported on Nov. 14. The attackers plant a Monero miner and a Gh0st RAT variant on compromised machines, according to the report.

Key facts

• FortiGuard Labs published the findings on Nov. 12, 2026 in a report by researcher Xiaopeng Zhang, following discovery of the activity in early October 2026.
• The attack tools try predefined logins against exposed databases, using a password list with more than 2,700 entries and usernames such as “sa” and “admin.”
• After gaining access, the attackers enable xp_cmdshell and run a downloader that pulls the Monero miner and Gh0st RAT from an attacker-controlled server.
• The mining payload is named MicrosoftEdgeUpdate.exe and mines Monero through XMRig using the server’s CPU.
• PANews, citing Crypto Briefing’s coverage of the same FortiGuard disclosure, reported that the campaign has been active at least since early October 2026.

How the intrusion unfolds

The entry point is the database login itself. The tooling searches for SQL Servers reachable from the internet and attempts logins from a predefined list, pairing passwords with administrative-looking usernames. Once inside, the attackers turn on xp_cmdshell, the SQL Server feature that opens a Windows command shell from within the database engine.

Microsoft’s documentation says xp_cmdshell is disabled on new SQL Server installations and should stay off in most cases. Some older applications still depend on it, but the company recommends switching it on only while a required task is running. Commands issued through the feature inherit the security permissions of the SQL Server service account, and Microsoft advises restricting access to highly privileged users or using a less-privileged proxy account when non-administrators need it. The company also warns that enabling or using xp_cmdshell can trigger audit tools.

From that shell, a downloader retrieves two payloads from an attacker-controlled server:

• MicrosoftEdgeUpdate.exe — the mining component, which uses the machine’s CPU to mine Monero through XMRig. Its configuration contains a wallet address and three mining pool addresses.
• winlogon.exe — a Gh0st RAT variant with keylogging, file management and remote command functions. Screen capture and remote desktop are supplied through plugins that were not present in the sample analyzed.

Persistence comes from registry entries, a Windows service and scheduled tasks. The RAT’s scheduled task runs every 30 minutes, according to Zhang’s analysis. Researchers examined the RAT without connecting to a live command server because that infrastructure had already been taken offline before analysis.

Both outlets describe the same two payloads and the same xp_cmdshell abuse vector. Crypto.news adds the detail that the RAT sample was never connected to a command server; PANews, citing Crypto Briefing, states plainly that the campaign has not been attributed to a specific actor — a point Crypto.news makes by noting the publication does not identify the attackers.

Why it matters

Exposed databases remain one of the cheapest ways for attackers to acquire processing power, and this campaign shows the same server can serve two purposes at once: quiet mining revenue and a persistent foothold for data theft. The payload naming is the giveaway — a program labeled as an Edge updater on a database server has no ordinary reason to be there.

The pattern is familiar. In July 2024, attackers used vulnerable file-sharing servers to spread Monero miners and remote-access malware, with AhnLab documenting XMRig, XenoRAT and Gh0stRAT installations on Rejetto HTTP File Server and at least four attackers, including the LemonDuck group. In August 2026, Apple patched a macOS flaw after Screen Sharing was exploited to install Monero miners, and the Netherlands’ National Cyber Security Centre confirmed intrusions on multiple systems in an Aug. 12 advisory. A January 2025 CrowdStrike recruitment scam also delivered XMRig through a fake job-application download. Each case ends the same way for the host: someone else’s electricity bill and someone else’s control.

What to watch

FortiGuard Labs has not published a victim count or named the operators, so the next meaningful data point will be whether other security firms corroborate the campaign and attach a number to it. Microsoft’s guidance to keep xp_cmdshell disabled unless a specific task requires it remains the practical control for database administrators in the meantime.

Market snapshot

Monero (XMR) traded at $535 (₹50,435) on Nov. 14, 2026, up 0.3% over 24 hours but down 12.6% over seven days, with a market cap of $10.08B and 24-hour volume of $115.5M, according to CoinPaprika data timestamped 12:38 UTC. Bitcoin stood at $67,196 (₹6,334,264), down 2.9% on the day and 11.4% on the week. The figures are market data, not a forecast, and the market is volatile and uncertain; this is not financial advice.

The campaign’s economics depend on mining quietly on hosts the operators do not own, which is why detection usually comes from server administrators noticing CPU load rather than from the blockchain itself. FortiGuard’s report, published five weeks after the activity was first spotted, leaves the size of the operation an open question for now.

Frequently Asked Questions

This post Monero miner and Gh0st RAT found on exposed SQL Servers first appeared on BitcoinWorld.