CampaignPublished 8 Aug 2025Updated 7 Sep 2025

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025

Source AlienVault OTX General

Description

The analysis team has categorized attacks on MS-SQL and MySQL servers installed on Windows systems during Q2 2025. While the number of targeted systems remains stable, attacks on MS-SQL servers have been decreasing. MySQL servers saw a significant spike in attacks in June 2025. The report provides detailed statistics on attack trends, including graphs illustrating the attack status for both server types. It also includes a list of MD5 hashes, URLs, FQDNs, and IP addresses associated with the malicious activities. The analysis covers various types of malware and tools used in these attacks, ranging from backdoors and miners to ransomware and remote access trojans.

Impact

For European organizations, this threat poses significant risks to the confidentiality, integrity, and availability of critical database assets. Compromise of MS-SQL or MySQL servers can lead to unauthorized data access, data exfiltration, and disruption of business operations. The presence of ransomware capabilities (e.g., T1486) can result in data encryption and operational downtime, with potential financial losses and reputational damage. Cryptocurrency miners embedded in infected servers may degrade performance and increase operational costs. The use of remote access trojans and backdoors facilitates persistent attacker presence, enabling further lateral movement within networks and potential escalation to other critical systems. Given the widespread use of Windows-based database servers across European industries—including finance, healthcare, manufacturing, and public sector—the impact can be broad and severe. Additionally, the spike in MySQL attacks suggests that organizations relying on this database platform may face increased targeting, necessitating heightened vigilance. The campaign's use of diverse malware and attack techniques complicates detection and response efforts, increasing the risk of prolonged compromise.

Defensive guidance

European organizations should implement targeted mitigation strategies beyond generic best practices: 1) Conduct thorough inventory and segmentation of database servers, isolating them from general network access to reduce exposure. 2) Enforce strict access controls and multi-factor authentication (MFA) for database administrative accounts to prevent credential abuse. 3) Regularly audit and harden database configurations, disabling unused services and enforcing least privilege principles. 4) Deploy advanced endpoint detection and response (EDR) solutions capable of identifying behaviors associated with known malware families and attack techniques referenced (e.g., lateral movement, credential dumping). 5) Monitor network traffic for communications with known malicious IPs and domains listed in the indicators of compromise, integrating threat intelligence feeds for real-time alerts. 6) Apply timely patches and updates to database software and underlying Windows OS, even though no known exploits are reported, to mitigate potential vulnerabilities. 7) Implement robust backup and recovery procedures, ensuring offline and immutable backups to mitigate ransomware impact. 8) Conduct regular threat hunting exercises focusing on signs of persistence mechanisms such as backdoors and RATs. 9) Educate IT and security teams on the specific tactics and malware families involved to improve detection and incident response readiness. 10) Restrict use of remote administration tools like AnyDesk unless strictly necessary and monitored.

Indicators of compromise

Domains 2

yyinfo8999.fit
star.zcnet.net

IP addresses 4

154.204.177.54
103.101.178.170
154.222.24.186
39.108.132.22

Hashes 11

2cd59cff23a2e0f98e710bf52b799154
33096e0bc0785ffb2094054bebb9be26
3ee3a5fef87b72a024bd0f45e6f6039f
454ff880e99d5777276bdee1a3e078d9
9d098864bc5746b9ff00432686d59b9f
93100ba55fcbb8e572ad231eec24e02fa744244a
960efb1f961ce6c8fbd4dfb09ba76f32882a5225
a56ccf64692edca0c60a68e0c374e23d13ce0111
046c011bbf14fa5d187bd4d5ac2a7cf1317f103ae2ba46769a451add5735c8e8
3389a0a7e2f8bee5fe7b4a9d8e45d75c6e3b75af5cec244ebdfb36699d29d89d

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 Aug 2025, 21:18 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 2

IP addresses 4

Hashes 11

Community reviews

Related threats