FortiGuard Labs: Hackers hijacked Microsoft SQL Server to deploy Gh0st RAT and Monero mining programs

According to Crypto Briefing, FortiGuard Labs has disclosed an attack activity targeting Microsoft SQL Server databases exposed on the internet. The attackers exploited weak passwords and misconfigurations to breach the servers through brute force, enabling the xp_cmdshell feature and implanting two types of malicious payloads: a Monero mining program disguised as MicrosoftEdgeUpdate.exe, and a variant of Gh0st RAT that supports functionalities such as keylogging and screen capturing.

Both payloads achieved persistence by modifying the registry and scheduled tasks. FortiGuard Labs stated that this activity has been active since at least early October 2026, and the number of victims has not yet been confirmed, nor has the attack been attributed to specific actors.