An active campaign targets Internet-facing Microsoft SQL Server instances by abusing T-SQL commands to deliver malware. Attackers scan for exposed servers on TCP port 1433 and use brute-force attacks with predefined credentials to gain access. Once authenticated, malicious T-SQL commands download and execute malware including a UPX-packed Go binary with the Naabu scanner, an XMRig cryptocurrency miner, and the Gh0st RAT remote access trojan. The malware enables CPU resource hijacking for Monero mining and provides extensive remote control capabilities such as keylogging and screen capture.