The threat actor Larva-26002 conducted sustained attacks on Windows MS-SQL and MySQL database servers during early 2026. They leveraged legitimate utilities to deploy a Go-based scanner called ICE Cloud, which attempts to authenticate to MS-SQL servers using predefined credentials. Attack techniques included brute force and dictionary attacks targeting weak or misconfigured accounts, as well as exploitation of unpatched vulnerabilities. The scanner has command-and-control capabilities and contains Turkish language strings. The attacks highlight risks from inadequate account management and unpatched database servers.

The attacks can lead to unauthorized access to database servers if brute force or dictionary attacks succeed against weak or misconfigured accounts. This could result in compromise of database integrity, confidentiality, or availability. The use of a scanner with C&C capabilities suggests potential for further malicious activity post-compromise. However, no specific exploits or widespread active exploitation are reported. The impact is medium severity due to the potential for unauthorized access but no confirmed active exploitation or zero-day vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Mitigation should focus on improving account management practices by enforcing strong, unique credentials and disabling or securing default or unused accounts. Regularly apply security patches to database servers to reduce exposure to known vulnerabilities. Monitor for use of utilities like BCP, curl, bitsadmin, and PowerShell in unusual contexts. Network-level controls to restrict access to database servers and use of multi-factor authentication where possible are recommended.