Weak Passwords on SQL Servers Lead to Cryptominer and Gh0st RAT Deployments
Fortinet researchers have identified threat actors exploiting weak credentials on internet-facing Microsoft SQL Servers to deploy cryptominers and the Gh0st RAT.
Threat actors are actively exploiting weak and default passwords on internet-facing Microsoft SQL Servers to gain unauthorized access and deploy malicious payloads, according to recent findings by Fortinet's FortiGuard Labs.
The campaign observed by researchers involves attackers scanning for vulnerable SQL Server instances and then leveraging easily guessable credentials, such as default passwords or weak combinations, to establish a foothold. Once inside, the attackers proceed to deploy a combination of cryptomining malware and the Gh0st Remote Access Trojan (RAT).
The use of cryptominers aims to leverage the compromised server's resources for illicit cryptocurrency mining, generating profit for the attackers. Simultaneously, the deployment of Gh0st RAT provides attackers with persistent remote access and control over the affected systems. This allows for further malicious activities, including data exfiltration, lateral movement within the network, or the deployment of additional malware.
This exploitation vector underscores a persistent and fundamental security risk: the inadequate protection of internet-facing services. Many organizations still rely on weak or default credentials for critical infrastructure like database servers, leaving them exposed to automated scanning and exploitation by opportunistic threat actors.
The findings highlight the importance of robust password policies, regular security audits, and network segmentation. Organizations are urged to ensure that all SQL Server instances are secured with strong, unique passwords and that access controls are strictly enforced. Furthermore, implementing intrusion detection and prevention systems can help identify and block such unauthorized access attempts.
While the specific scale and targeted industries of this particular campaign are still under investigation, the methodology employed is a common tactic in the cybercriminal playbook. The dual deployment of cryptominers and RATs indicates a strategy focused on both immediate resource exploitation and establishing long-term access for potential future attacks or monetization.
Fortinet advises system administrators to immediately review their SQL Server configurations, enforce multi-factor authentication where possible, and ensure all systems are patched and up-to-date. Regularly changing default credentials and disabling unnecessary services can also significantly reduce the attack surface. The ongoing threat posed by weak authentication mechanisms remains a critical concern for database security.
The continued prevalence of such attacks serves as a stark reminder that even seemingly basic security hygiene, like strong password management, remains a cornerstone of effective cybersecurity defense against a wide array of threats, from financial gain via cryptomining to espionage via RATs.