T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers

An active campaign targets Internet-facing Microsoft SQL Server instances by abusing T-SQL commands to deliver malware. Attackers scan for exposed servers on TCP port 1433 and use brute-force attacks with predefined credentials to gain access. Once authenticated, malicious T-SQL commands download and execute malware including a UPX-packed Go binary with the Naabu scanner, an XMRig cryptocurrency miner, and the Gh0st RAT remote access trojan. The malware enables CPU resource hijacking for Monero mining and provides extensive remote control capabilities such as keylogging and screen capture.

• Noodle RAT: A Recipe for Cross Platform EspionageMalware2026-09-16
• Canto incognito: tracking the PoeLLM malwareMalware2026-10-08
• Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines CryptoMalware2026-11-06
• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• Autonomous LLMjacking: 'Skynet' Agent Hijacks Exposed AI Models to Run AttacksMalware2026-10-21