Attackers are still finding Microsoft SQL Server systems exposed to the internet with weak administrator passwords, and one crew has worked out how to get more out of them than mining revenue. Researchers at the AhnLab Security Intelligence Center (ASEC) have detailed a case in which a threat actor they track as Larva-26009 broke into an MS-SQL server, installed ordinary remote control software, added hidden backdoor accounts, and then stood up a VPN server on the victim machine to fold into its own command infrastructure.
The crypto mining was the visible part. XMRig, the commodity Monero miner, arrived as the final payload, pulled down as a zip archive using the built-in Windows tool bitsadmin and unpacked into a folder dressed up as a Microsoft Edge update directory. The rest of the intrusion is the interesting bit.
Legitimate tools instead of malware
Rather than deploy a conventional backdoor, the actor installed GotoHTTP and Chrome Remote Desktop, both mainstream remote access products that look unremarkable on an administrator machine and are awkward to block outright. It also planted VShell, a Go-based backdoor that talks to its server over TCP, HTTP or UDP and accepts plugins including Mimikatz and the Fscan network scanner.
Persistence came from several directions at once. Web shells were dropped onto any IIS web server in reach, decoded on disk with certutil, including an ASPX command shell and the Suo5 tunneling shell. A PowerShell-based web shell listening on port 37681 gave the actor equivalent control on machines running no web server at all. Backdoor Windows accounts named MSSQLSERVERS, mssql and adminweb1, each with a trailing dollar sign that hides them from the usual account listings, were added by a batch script whose comments were written in Chinese.
Credential theft and privilege escalation
ASEC saw the actor save the SYSTEM registry hive to disk, a standard first move toward extracting cached credentials, and found HackBrowserData staged on the actor download server, an open-source tool for pulling saved passwords, cookies and browsing history out of Chromium browsers, Firefox and Safari. A collection of privilege escalation utilities from the Potato family, including JuicyPotatoNG, SigmaPotato, BadPotato and RustPotato, sat alongside it.
Payloads were kept off disk wherever possible. The actor used RingQ, a public tool that decrypts an adjacent encrypted file and runs the result in memory, and in one case patched the code section of a legitimate NVIDIA utility so it would load and decrypt a payload hidden in a file named gojoke[.]png. Cloudflared was used in some cases to expose local ports outward without touching a firewall rule.
The victim machine becomes infrastructure
The detail that separates this from routine cryptojacking is the SoftEther VPN server. Its configuration shows the compromised host was not run as a standalone VPN endpoint but in cascade mode, chaining onward to another VPN server. ASEC assesses that the actor is using compromised machines to build layered command infrastructure that obscures where its real servers sit. If that assessment holds, an organization that shrugs off a mining infection as a nuisance is also unknowingly hosting a relay for somebody else intrusions.
Indicators
Selected indicators from the report, defanged: 159[.]223[.]46[.]140 and 38[.]60[.]253[.]35; the typosquatted domains microsftapiedge[.]com and update[.]microsftapiedge[.]com; and staging URLs hxxps://imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com/GotoHTTP_x64[.]exe and hxxps://ams-pub-dev[.]s3[.]dualstack[.]eu-west-1[.]amazonaws[.]com/test/hub/update[.]zip.
What to do about it
The entry point in cases like this is almost always the same: a database server reachable from the internet protected by a guessable administrator password. Keep MS-SQL off the public internet or behind strict access control, use passwords that survive a dictionary attack and rotate them, and audit for unexpected local accounts ending in a dollar sign as well as for remote access agents nobody authorized. AhnLab has documented comparable mining intrusions on the other side of the fence, including a self-spreading miner hitting weakly secured Linux SSH servers, and the same in-memory loading tradecraft in the AtlasRAT loader chain. The full case study is on the ASEC blog.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.