SQL Server Malware: Internet-Facing Microsoft SQL Servers Hit With a Monero Miner and Gh0st RAT, What Is Confirmed and What to Check This Week

Researchers at Fortinet say attackers are compromising Microsoft SQL Server databases that can be reached from the internet. They load each server with two pieces of malware: a cryptocurrency miner and a remote access trojan. If your business runs SQL Server behind a website, an ordering system or an accounting app, and that server accepts connections from the open internet, check it this week.

What happened to these Microsoft SQL Servers

Fortinet's threat research team writes that it "uncovered an active campaign targeting Internet-facing Microsoft SQL Server instances". Put simply, someone is hunting for SQL Server databases that answer from the public internet, getting into them and installing their own software.

Fortinet's report names two payloads:

• A Monero miner. Fortinet says "it is a Monero (XMR) cryptocurrency miner that uses the compromised SQL Server's CPU". Your server's processor does the attacker's mining work, and your applications get whatever capacity is left.
• A remote access trojan. Fortinet writes: "It was identified as a Gh0st RAT variant." A remote access trojan (RAT) is a tool that lets an outsider control a machine from somewhere else. The name is spelled with a zero in place of the o, though many people search for it as Ghost RAT.

CyberPress covered the report. It says the miner connects to the mining pool xmr-ru.kryptex.network, and it names two Fortinet detections: the FortiGuard IPS signature MS.SQL.Server.Brute.Force.Login and the antivirus signature W64/MSSQLBruteforcer.F62C!tr.

What is confirmed and what is not

The row that matters most is how the attackers get in. Both detection names refer to brute force, the security term for trying password after password until one works. That is a strong hint about how these servers were entered. The sources we checked do not describe the break-in in full, though, so we are not calling it confirmed.

No CVE or vulnerable SQL Server version is named. So there is no single patch that closes this off. Our reading of that: a fully updated server with a weak login and a database port open to the internet could still be at risk.

Is my SQL Server exposed to the internet? How to check

These three questions settle most of it:

1. Can the database be reached from outside your network? Ask whoever manages your firewall or cloud network rules whether the SQL Server accepts connections from any address, or only from specific ones such as your own app servers or a VPN.
2. Which logins can connect? List the database logins that use a password. Mark any that are shared, unused, old or have a password someone could guess.
3. Is anyone knocking? Review the login records your server and firewall keep. A long run of failed logins from unfamiliar addresses is what password guessing looks like.

If the first question's answer is that the database accepts connections from any address on the internet, that is the fix to make first. For how a public website and the systems behind it should be laid out, see Your Website Is Live. Can Anyone Find It, and Is It Locked?.

What to do this week

Why this matters for a business network

A SQL Server is rarely just a database. It holds customer records, orders, invoices and logins, and it is usually wired into your web servers and internal systems. If it is compromised, more than one system is affected.

The miner is the noisy part. It eats processor time, which can show up as slow pages, timeouts in your apps or a higher bill if you pay for cloud computing by usage. The remote access trojan is the quiet part. Our sources do not say what the attackers did with that access, and we will not guess. What is clear is that a machine someone else can control from outside is a machine you can no longer vouch for, along with everything it can reach.

There is also a question of ownership. Plenty of databases end up exposed because a vendor opened access during setup and nobody closed it again. If you do not know who is responsible for that server's firewall rules and logins, read Who Is Patching the Software That Runs Your Business?. If you host your own systems, our self-hosting and infrastructure page explains how we keep databases behind the application rather than on the open internet.

SQL Server malware questions people are asking

Is there a SQL Server vulnerability or CVE behind this?

None is named. The sources do not link this campaign to a CVE or to a specific SQL Server version, so whether any flaw is involved is not known.

Is there a patch I can install?

No patch is named, because no flaw is named. Keep SQL Server updated anyway. For this campaign, though, what protects you is limiting who can reach the server and making sure every login has a strong password.

How can I tell if my SQL Server is mining cryptocurrency?

Two signs: CPU on the database server that stays high with no matching workload, and network connections to xmr-ru.kryptex.network. If you see either one, treat the server as compromised.

What is Gh0st RAT?

It is a remote access trojan: malware that lets an outsider control a computer remotely. Fortinet identified a Gh0st RAT variant on the compromised SQL Servers in this campaign. It is often searched as Ghost RAT.

Does this affect SQL Server in the cloud?

The report describes internet-facing instances. It does not say whether those servers were in offices, data centres or the cloud. Any instance that can be reached from the internet fits the description.

Who is behind the SQL Server attacks?

That is not known from the sources. They do not name a group or a country.

The bigger lesson

If a database can be reached from anywhere, someone will try to log in from anywhere. Most of this attack is stopped by two plain habits: keep the database off the open internet, and give no login a password that can be guessed.

To have your servers and databases reviewed and locked down, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Fortinet threat research: T-SQL being abused to deliver malware on compromised MS SQL servers; CyberPress.