FortiGuard Labs disclosed on November 12, 2026, a campaign targeting internet-facing Microsoft SQL Server instances that uses weak or default passwords to install both a Monero cryptocurrency miner and a Gh0st remote-access trojan variant. The activity was first observed in early October 2026. Attackers scan for publicly reachable SQL Servers, brute-force administrative logins with a list exceeding 2,700 common passwords paired with usernames such as “sa” and “admin,” then abuse T-SQL commands to enable xp_cmdshell and deploy payloads.
The miner, dropped as MicrosoftEdgeUpdate.exe, is based on XMRig and hijacks the compromised server’s CPU to mine Monero, communicating with known mining pools. The second payload, delivered as winlogon.exe, is a Gh0st RAT variant that supports keylogging, file management, data theft, remote shell execution and more than 30 control commands; plugins can add screen capture and remote desktop functionality. Persistence is achieved through registry entries, a Windows service and scheduled tasks. No specific threat actor or confirmed victim count has been publicly attributed, and some associated command-and-control infrastructure was offline during analysis.
The Drivers of the Current Situation
The main issue is the continued exposure of Microsoft SQL Server instances to the public internet with weak authentication. Once administrative access is obtained through brute force, attackers gain the ability to execute operating-system commands via the xp_cmdshell feature without needing complex exploits. This allows rapid deployment of both cryptojacking and remote-access malware.
Related factors shaped the campaign’s effectiveness. Many installations leave the default “sa” account enabled or use easily guessed passwords. Enabling xp_cmdshell—disabled by default in modern SQL Server installations—grants the attackers a direct command shell under the database service account’s privileges. Only the confirmed use of weak-password brute forcing, the dual Monero miner and Gh0st RAT payloads, the abuse of xp_cmdshell, the observed persistence methods, and the absence of a named actor or quantified victim tally are verified. Broader trends in opportunistic scanning of exposed database ports contributed to the activity’s scale.
Continued monitoring requires observation of additional compromised servers, the status of related command-and-control domains, and whether defenders apply recommended hardening. Limited public detail on the exact number of affected systems forms a narrower path for assessing overall impact. Database administrators, security teams and threat-intelligence researchers remain the primary parties tracking residual effects. The situation is an opportunistic cryptojacking and remote-access campaign that exploits basic configuration weaknesses rather than novel vulnerabilities.
Impact and Broader Context
Questions about the ongoing exposure of database servers keep growing. The dual-payload approach creates uncertainty about whether the primary goal is resource theft through Monero mining or longer-term data access via the RAT. It also elevates attention on the risks of leaving SQL Server instances internet-facing without strong authentication and proper feature restrictions. Organizations running Microsoft SQL Server, managed-service providers and security vendors continue to assess the implications.
The issue drives debate on basic cyber-hygiene for critical infrastructure. It raises questions about the durability of default or weak credentials, the limits of relying on features such as xp_cmdshell remaining disabled, risks of similar campaigns expanding to other database platforms, effects on near-term operational costs from unauthorized mining, and competition among threat actors for easily compromised compute resources. Coverage notes that the campaign requires no sophisticated zero-day and succeeds primarily through poor configuration practices.
The November 12 FortiGuard disclosure forced renewed focus on internet-exposed SQL Servers. The current findings show how further detections, password-hardening campaigns, or additional payload variants will determine the lasting effect.
New indicators of compromise, updated mitigation guidance, or confirmed large-scale infections will clarify the practical scale of the campaign.
This analysis uses the FortiGuard Labs report and contemporaneous security coverage. The ultimate number of affected systems and the longevity of the operation remain subject to ongoing defensive responses and attacker adaptation.