FortiGuard Labs Identifies SQL Server Attacks Using Monero Miner and Gh0st RAT

FortiGuard Labs has identified a campaign targeting internet-facing Microsoft SQL Server systems with a Monero miner and a Gh0st RAT variant, leaving the number of affected victims unknown.

Attackers used brute force, exploiting weak passwords and configuration errors, then enabled xp_cmdshell before installing the payloads. The miner was disguised as MicrosoftEdgeUpdate.exe. The Gh0st RAT variant can record keystrokes and capture screenshots.

Registry changes and scheduled tasks help keep both payloads running. The campaign has been active since at least early October 2026. The victim count remains unconfirmed, and the activity has not been attributed to a specific actor.