Exposed SQL Servers Targeted for Monero Mining and Remote Access

FortiGuard Labs has identified an offensive campaign that compromises internet-facing Microsoft SQL Servers and installs two distinct payloads: software for mining Monero and the Gh0st remote-access trojan, or RAT. The research was presented in a Nov. 12 report by researcher Xiaopeng Zhang, according to Bitcoin World, while Crypto.news likewise attributes the findings to FortiGuard Labs.

The malware components serve different purposes. The mining software turns compromised computing resources into an XMR hashing operation, while Gh0st RAT gives the attacker remote-control capabilities. Crypto.news specifically says the RAT can steal data and control infected machines, making the campaign broader than cryptojacking alone and giving the operator a potential persistence and collection mechanism.

The two outlets corroborate the core findings: exposed Microsoft SQL Servers are the initial target, Monero mining software and Gh0st RAT are both involved, and FortiGuard Labs documented the activity. Bitcoin World foregrounds the pairing of a miner and remote-access tool, whereas Crypto.news places more emphasis on the RAT’s data-theft and machine-control functions. Neither summary reports the number of affected servers, their locations, the operator’s identity, or the amount of Monero mined.

The vulnerability is specifically tied to SQL Servers that remain directly exposed to the internet. That places database infrastructure commonly used for application data in the path of both unauthorized mining and remote intrusion. The supplied coverage does not state how the servers were breached or whether particular software versions were implicated, so it does not support a more specific assessment of affected systems.

The broader crypto market was weak when the research surfaced. Bitcoin World and Crypto.news report no market impact directly attributable to the campaign, but live data show Bitcoin down 4.20% over 24 hours, Monero at $508.96 with a 3.51% daily decline and a 16.85% seven-day loss, and total crypto market capitalization at $2.29 trillion. The Fear & Greed index stood at 13, labelled Extreme Fear. The live figures provide market context but do not measure the campaign’s financial scale or its effect on Monero.

What is established is the combination of internet-facing SQL Server exposure, unauthorized Monero mining, and Gh0st RAT deployment. The relevant indicators for defenders are therefore the presence of unauthorized miner processes, remote-access malware, or unauthorized control activity on exposed systems; the available coverage does not establish how many such instances remain active or how much hashing power the campaign controls.