Monero Miners and Gh0st RAT Target Exposed SQL Servers

FortiGuard Labs has uncovered a campaign that breaks into internet-facing Microsoft SQL Servers to install Monero mining software and remote-access malware capable of stealing data and controlling infected machines. According to CryptoNews, attackers use weak database passwords to install a Monero miner and a Gh0st RAT variant.

Attack Vector and Payloads

The research details that attack tools search for exposed databases and attempt to log in using predefined credentials. The password list contains more than 2,700 entries, paired with usernames such as sa and admin. After gaining access, the attackers run database commands that enable xp_cmdshell and install a downloader that retrieves the Monero miner and Gh0st RAT from an attacker-controlled server.

The mining payload, MicrosoftEdgeUpdate.exe, uses the compromised machine's CPU to mine Monero through XMRig. Its configuration contains a wallet address and three mining pool addresses. A second payload, winlogon.exe, is a Gh0st RAT variant equipped with keylogging, file management, and remote command capabilities. Persistence mechanisms include registry entries, a Windows service, and scheduled tasks that run every 30 minutes.

Key facts

• FortiGuard Labs detailed the operation in a report published Nov. 12, following discovery in early October 2026.
• Attackers target internet-facing Microsoft SQL Servers using a password list of more than 2,700 entries.
• The campaign installs XMRig to mine Monero disguised as a Microsoft Edge updater.
• A Gh0st RAT variant with keylogging and file management capabilities is also deployed.