MalwarePublished 22 Apr 2025Updated 22 May 2025

Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin

Source AlienVault OTX General

Description

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malware includes Ammyy Admin (mscorsvw.exe), its settings file (settings3.bin), and PetitPotato (p.ax). The attackers utilize an old version of Ammyy Admin (v3.10) and employ known exploitation methods to gain remote control. They also use PetitPotato for privilege escalation, adding new users and activating RDP services. To prevent such attacks, administrators are advised to use strong passwords, update software regularly, and implement security measures like firewalls.

Impact

For European organizations, the impact of this threat can be significant, especially for entities relying on MS-SQL servers for critical business operations. Successful exploitation can lead to unauthorized remote control of servers, enabling attackers to exfiltrate sensitive data, manipulate databases, or use the compromised infrastructure as a foothold for lateral movement within the network. The installation of Ammyy Admin allows persistent remote access, increasing the risk of prolonged undetected compromise. Privilege escalation via PetitPotato further exacerbates the threat by granting attackers administrative control, which can lead to disabling security controls, deploying ransomware, or establishing backdoors. Organizations in sectors such as finance, healthcare, manufacturing, and government are particularly at risk due to their reliance on MS-SQL databases and the sensitivity of stored data. Additionally, enabling RDP services and adding new users can facilitate further attacks or insider threats. The medium severity rating reflects that while the attack requires some initial misconfiguration (weak passwords, unpatched servers), the consequences can be severe if exploited. The threat also poses reputational and regulatory risks under GDPR if personal data is compromised. Given the use of legitimate tools like Ammyy Admin, detection may be challenging, increasing dwell time and potential damage.

Defensive guidance

To mitigate this threat effectively, European organizations should implement the following specific measures beyond generic advice: 1) Enforce strong, complex passwords and implement account lockout policies on MS-SQL servers to prevent brute force and dictionary attacks. 2) Disable or restrict remote access protocols such as RDP unless absolutely necessary, and enforce network-level authentication and multi-factor authentication (MFA) for remote connections. 3) Regularly audit MS-SQL server configurations and patch all known vulnerabilities promptly, including underlying Windows OS patches that address privilege escalation vectors exploited by PetitPotato. 4) Monitor for unusual process executions and network connections, specifically looking for the presence of 'mscorsvw.exe' in unexpected contexts and the download of files via WGet or similar tools. 5) Implement application whitelisting to prevent unauthorized execution of tools like Ammyy Admin and PetitPotato. 6) Conduct regular user account reviews to detect unauthorized additions and disable unused accounts. 7) Employ network segmentation to isolate database servers from general user networks and limit lateral movement. 8) Use endpoint detection and response (EDR) solutions capable of detecting privilege escalation and remote control tool behaviors. 9) Educate administrators on the risks of using outdated remote control software versions and encourage the use of secure, updated alternatives. 10) Establish comprehensive logging and alerting for MS-SQL authentication failures and privilege escalation attempts to enable rapid incident response.

Indicators of compromise

URLs 4

http://1.220.228.82/mscorsvw1.log
http://1.220.228.82/settings3.bin
http://110.45.186.8/aa_v3_protected.exe
http://110.45.186.8/mscorsvw.log

Hashes 8

1c9c3b4a2753ecab833621701e1b492c
55f4a1393e2edafea92d7ebab09c92d6
753f5e2fc5bdbc9b2175913d3b883580
b3b9eb83af47770dbb8e86f95afe9634
1af757d777b664e6048e4001f45c7e004ab65f47
c0f17c77a25475496f23c6296ce1043aaed00f83
9d019136cb08075cc3c25e23ccff919b16eb79060c45ceba1004edc96980416d
ce226d9a3a2c25c4d8f8f333aede73692f76be51423948084eba360b2fed2547

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 04:08 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

URLs 4

Hashes 8

Community reviews

Related threats