Newshot Attackers Brute-Force Public Microsoft SQL Servers, Over 2,700 Password Guesses Used to Deploy RAT and Cryptominer
A new wave of attacks is compromising Microsoft SQL Server systems exposed to the public internet through password guessing. Attackers use a dictionary containing more than 2,700 passwords to attempt logins and, upon success, install a cryptocurrency miner and a remote access trojan (RAT) on the compromised machine.
This campaign has been active at least since early October 2026. Database servers store high-value data and have long been prime targets for attackers. The attack first scans exposed servers on the public internet, attempts logins in bulk, and after success executes commands to pull additional malware.
Such basic attack techniques have existed for years; earlier this year, attackers were already using scanning malware to continuously attack MS-SQL servers.
Researchers from Fortinet's FortiGuard Labs fully disclosed the malware's infection chain in a report released on November 12, 2026.
FortiGuard Labs analyst Xiaopeng Zhang noted that the campaign abuses T-SQL, Microsoft SQL
Attackers Brute-Force Internet-Exposed Microsoft SQL Servers, Using Over 2,700 Password Guesses to Deploy RATs and Cryptominers
| Type | Indicator | Description |
|---|---|---|
| Domain | site.vietnam852[.]com:88 | Campaign file server |
| Domain | ftp.vietnam852[.]com:88 | FTP and registration server |
| Domain | server.vietnam852[.]com:8000 | Gh0st RAT C2 |
| Domain | www.swordaa[.]com:8000 | Gh0st RAT C2 |
| Domain | site.hfgjjkrewjk[.]com | Mining status reporting |
| Domain | site.jiancai008[.]com | Payload hosting |
| URL | hxxp://site.vietnam852[.]com:88/ip.php | Target IP range |
| URL | hxxp://site.vietnam852[.]com:88/2026/2018.sql | Malicious T-SQL |
| URL | hxxp://site.vietnam852[.]com:88/2026/dwm.exe | Brute-force tool |
| URL | hxxp://site.vietnam852[.]com:88/down.exe | Downloader |
| URL | hxxp://ftp.vietnam852[.]com:88/post.php | Host registration |
| URL | hxxp://site.jiancai008[.]com:88/test/winlogon.exe | Gh0st RAT |
| URL | hxxp://ftp.vietnam852[.]com:88/test/MicrosoftEdgeUpdate.exe | XMR miner |
| URL | hxxp://site.vietnam852[.]com/tj/xmr.php?data= | Miner reporting |
| SHA-256 | 8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D | dllhost.exe |
| SHA-256 | F5444E8E9E9E019693AACB363B7441AC0B8ECFE96A77FD94B9C312A017588EB4 | 2018.sql |
| SHA-256 | 2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379 | go.bat |
| SHA-256 | 79596CF6E267EF5CB658BD97D04E42A41001D36595E370441ADB3C2B5DD5666C | go.vbs |
| SHA-256 | D6E3FD28F479138B336E2C2088AD2E86B7646A163AA453B1703905A4B359070F | sqlcmd.exe |
| SHA-256 | 124774698FD3EDE0800015D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0 | dwm.exe |
| SHA-256 | 125D3A0EFE7699BB20397C13F0F4993AD893952727487B4D190E386A5B14C427 | down.exe / Google.exe / payload.exe |
| SHA-256 | 20983573B840447E1AACD6D3F6DD240732B15037D268D6456F0D3C4EC5051CB0 | down.exe / Google.exe / payload.exe |
| SHA-256 | 58DB0CA2054ABE2989412D7A1C8ED16718577F893C196825C848FCD56C7E8F05 | Embedded downloader in 2018.sql |
| SHA-256 | 2A23E10BFC097E98295CBFF8124BD403C4CB677E709B48CCC53D6ACA216C3061 | MicrosoftEdgeUpdate.exe (XMR miner) |
| SHA-256 | DA4128AA5D006E05C58F0D240C2D8E5FB02774B6ACF314F1230059C7A3498724 | MicrosoftEdgeUpdate.exe (XMR miner) |
| SHA-256 | 3F64B0146B323C5716043360E84384A5A197A897F46088DF93A910470A29E1A0 | winlogon.exe (Gh0st RAT) |
Note: All IP addresses and domain names have been defanged (for example, replacing . with [.] ) to prevent users from accidentally resolving or clicking on malicious links. Please only re-fang the addresses in controlled threat intelligence platforms such as MISP, VirusTotal, or an internal SIEM.
Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware