Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The analysis team has categorized attacks on MS-SQL and MySQL servers installed on Windows systems during Q2 2025. While the number of targeted systems remains stable, attacks on MS-SQL servers have been decreasing. MySQL servers saw a significant spike in attacks in June 2025. The report provides detailed statistics on attack trends, including graphs illustrating the attack status for both server types. It also includes a list of MD5 hashes, URLs, FQDNs, and IP addresses associated with the malicious activities. The analysis covers various types of malware and tools used in these attacks, ranging from backdoors and miners to ransomware and remote access trojans.

The provided report details a campaign of malware attacks targeting Windows-based database servers, specifically MS-SQL and MySQL, during the second quarter of 2025. The analysis highlights a stable number of targeted systems overall, with a notable decrease in attacks against MS-SQL servers but a significant spike in attacks targeting MySQL servers in June 2025. The malware involved encompasses a broad spectrum of threats, including backdoors, cryptocurrency miners, ransomware, and remote access trojans (RATs). The campaign leverages various tools and malware families such as ShadowForce, JuicyPotato, Cobalt Strike, Remcos, Loveminer, and MyKings, indicating a multi-faceted attack approach. Techniques referenced by MITRE ATT&CK IDs (e.g., T1133, T1082, T1190, T1486) suggest exploitation of network services, credential dumping, lateral movement, persistence, and ransomware deployment. Indicators of compromise (IOCs) include multiple IP addresses, domain names, and file hashes associated with malicious payloads and command-and-control infrastructure. The absence of known exploits in the wild implies that the attacks may rely on a combination of credential theft, misconfigurations, and possibly zero-day or unpatched vulnerabilities. The report also references external analysis by AhnLab, providing further technical insights. Overall, this campaign represents a persistent and evolving threat to Windows database servers, with a shift in attacker focus from MS-SQL to MySQL environments.

Detailed information about Statistics Report on Malware Targeting Windows Database Servers in Q2 2025. Get real-time updates, technical details, and mitigation 

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell, Maggie, and Wgdrop. Their activities involve three stages: initial access and reconnaissance, backdoor deployment, and additional malicious behaviors. The group has connections to China and has been quietly stealing information for over 13 years without demanding ransom or releasing stolen data. Their persistent activity suggests preparation for potential large-scale attacks in the future.

TA-ShadowCricket, previously known as Shadow Force, is an advanced persistent threat (APT) group active since 2012, primarily targeting Windows servers and Microsoft SQL (MS-SQL) servers. The group operates an IRC server infrastructure controlling over 2,000 infected IP addresses across 72 countries, indicating a broad global footprint. Their malware toolkit includes several specialized tools such as Upm, SqlShell, Maggie, and Wgdrop, which facilitate multi-stage operations. The attack lifecycle consists of initial access and reconnaissance, followed by backdoor deployment, and culminating in additional malicious activities such as credential theft, lateral movement, and possibly cryptomining. Notably, TA-ShadowCricket has maintained a low profile by quietly exfiltrating sensitive information without engaging in ransom demands or public data leaks, suggesting a strategic intent to build long-term access for potential future large-scale operations. The group’s ties to China and their sustained activity over more than a decade underscore their persistence and sophistication. The use of IRC for command and control (C2) is a classic technique that enables stealthy communications and botnet management. The threat leverages multiple MITRE ATT&CK techniques including credential dumping (T1003), persistence (T1543), remote services exploitation (T1021.001), and obfuscated files or information (T1027), among others, highlighting a comprehensive and adaptable attack methodology. Despite no known public exploits currently in the wild, the extensive infection base and the variety of tools employed make this a significant threat to organizations running vulnerable Windows and MS-SQL server environments.

Detailed information about TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking. Get real-time updates, technical details, and mitigation strategie

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking - Live Threat Intelligence - Threat Radar | OffSeq.com

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malware includes Ammyy Admin (mscorsvw.exe), its settings file (settings3.bin), and PetitPotato (p.ax). The attackers utilize an old version of Ammyy Admin (v3.10) and employ known exploitation methods to gain remote control. They also use PetitPotato for privilege escalation, adding new users and activating RDP services. To prevent such attacks, administrators are advised to use strong passwords, update software regularly, and implement security measures like firewalls.

This threat involves a series of attacks targeting poorly managed Microsoft SQL (MS-SQL) servers. Attackers exploit weak security configurations, primarily through brute force and dictionary attacks against MS-SQL authentication, to gain initial access. Once access is obtained, they execute commands to gather system information (technique T1082) and use WGet to download and install additional malware components. The primary malware installed is an outdated version (v3.10) of Ammyy Admin, a legitimate remote control tool, disguised as 'mscorsvw.exe' alongside its configuration file 'settings3.bin'. Additionally, the attackers deploy PetitPotato (p.ax), a known privilege escalation tool that exploits Windows token impersonation vulnerabilities to elevate privileges (technique T1068). With escalated privileges, the attackers create new user accounts and enable Remote Desktop Protocol (RDP) services to maintain persistent remote access. The attack chain leverages multiple MITRE ATT&CK techniques including brute force (T1110), remote service exploitation (T1021), command execution (T1059), and persistence via new user creation (T1136). The use of an outdated Ammyy Admin version suggests reliance on known vulnerabilities or lack of detection signatures. The attackers exploit common misconfigurations such as weak passwords and unpatched MS-SQL servers, emphasizing the importance of proper server hardening. No specific affected product versions are listed, indicating the attack targets any MS-SQL server with weak security. There are no known exploits in the wild beyond these observed attacks, and no CVSS score is assigned. The threat is rated medium severity by the source, reflecting moderate impact potential and exploitation complexity.

Detailed information about Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'ms-sql'

Filter Threats

Threats Tagged 'ms-sql'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility