Q3 2026 Statistical Report on Malware Targeting Windows Database Servers

This report details a series of attacks during Q3 2026 targeting Windows MS-SQL and MySQL database servers. Attack vectors included brute-force and dictionary attacks alongside exploitation of vulnerabilities. The threat actors deployed multiple malware and tools such as XMRig cryptocurrency miners, GotoHTTP backdoors, SoftEther VPN servers operating in Cascade Connection mode for C2, and web shells including Sharp4WebCmd, Suo5, and PowerShell-based shells. Additional utilities like VShell, HackBrowserData, Fscan, and Cloudflared were used for remote command execution, credential theft, network reconnaissance, and port exposure respectively. The root causes were primarily weak passwords, improper account management, and inadequate security controls on externally facing database servers.

The attacks resulted in unauthorized access to database servers, enabling cryptocurrency mining, credential theft, persistent backdoors, and command and control infrastructure establishment. This compromises confidentiality, integrity, and availability of affected database servers. The use of backdoor accounts and VPN infrastructure facilitates ongoing attacker presence and lateral movement. The exploitation of weak security practices increases risk of data breaches and operational disruption.

No official patch or fix is applicable as this is a report on attack activity rather than a specific vulnerability. Mitigation focuses on strengthening security controls: enforce strong, complex passwords; implement account management best practices; restrict external exposure of database servers; monitor for unauthorized accounts and unusual VPN activity; and deploy detection for known malware and web shells identified in this report. Regularly update and harden database server configurations to reduce attack surface.