Weak SQL Server Passwords Lead to Cryptominer and Gh0st RAT Infections

A campaign has been breaking into internet-facing Microsoft SQL Server instances with weak passwords to install a Monero cryptominer and a Gh0st remote access trojan, according to Fortinet's FortiGuard Labs research published November 12, 2026. The attack, rated high severity, used a Go payload with the Naabu port scanner to find SQL Servers on TCP port 1433, then brute-forced over 2,700 passwords against usernames like "sa" and "admin." After gaining access, malware enabled xp_cmdshell to run commands, downloaded a loader, and scheduled persistent execution. The cryptominer, disguised as a Microsoft Edge update, used server processors, while the Gh0st RAT variant supported keylogging, screen capture, and data theft. The report did not disclose the number of compromised servers or the attackers' identity.