Q1 2026 Malware Statistics Report for Windows Database Servers

During the first quarter of 2026, Windows-based MS-SQL and MySQL database servers experienced consistent malicious attacks with a temporary decrease in February before rising again in March. The primary threat actor, Larva-26002, leveraged various utilities including BCP, curl, bitsadmin, and PowerShell to deploy a Go-based scanner called ICE Cloud, which contained Turkish language strings and C&C-based scanning capabilities. This tool attempted MS-SQL authentication using predefined credentials. Attack methods primarily consisted of brute force attacks, dictionary attacks, and exploitation of unpatched systems with misconfigured accounts stemming from inadequate account management practices.

• Statistics Report on Malware Targeting Windows Database Servers in Q2 2025Campaign2025-08-08
• XiebroC2 Identified in MS-SQL Server Attack CasesMalware2025-10-01
• Q3 2026 Statistical Report on Malware Targeting Windows Database ServersMalware2026-10-14
• Case of Attacks Targeting MS-SQL Servers to Install Ammyy AdminMalware2025-04-22
• Attacks Targeting Linux SSH Servers to Install SVF DDoS BotMalware2025-08-20