Content

The AhnLab SEcurity intelligence Center (ASEC) observed and classified attacks targeting MS-SQL servers and MySQL servers installed on Windows operating systems via the ASD infrastructure. This report summarizes the damage status, attack status, and the types of malware used in the attacks, based on logs identified in the third quarter of 2026.

Purpose and Scope

This report covers statistics on attacks targeting MS-SQL servers and MySQL servers and the classification of the malware used. It also describes, through actual attack cases, the patterns in which web shells, backdoors, CoinMiner, and VPN tools are used in combination. Damage status refers to systems where control was gained by malware or a threat actor and a history of malware installation was confirmed.

Attack Cases

In attack cases from the third quarter of 2026, XMRig, GotoHTTP, and SoftEther were used. Threat actors executed malicious commands on MS-SQL servers to download additional payloads and installed web shells to maintain persistence. The web shells used included Sharp4WebCmd (a command execution ASPX web shell), Suo5 (with tunneling capabilities), and a PowerShell web shell. The PowerShell web shell used the username “joke” for basic authentication.

Additionally, the threat actor executed GotoHTTP in memory using an encrypted file and RingQ, and added the backdoor accounts “MSSQLSERVERS$” and “mssql$” to enable future RDP remote control. VShell (a Go-based backdoor) was also used, providing remote command execution and file management capabilities. The threat actor attempted to engage in credential theft using the reg save HKLM\SYSTEM command and also utilized HackBrowserData (a tool for stealing browser-stored information), Fscan (an internal network scanner), and Cloudflared (a tool for exposing local ports). Finally, XMRig was installed to mine Monero, and evidence was found that a SoftEther VPN server was operated in Cascade Connection mode and used as C&C infrastructure.

Conclusion

The report shows that the primary causes of database server attacks include not only the exploitation of vulnerabilities but also brute-force and dictionary attacks, as well as improper account management. In particular, MS-SQL and MySQL servers are easy targets for various threat actors and malware, often leaving multiple attack traces of infection simultaneously. The report concluded that it is necessary to use strong passwords, change them periodically, apply the latest patches, and implement firewalls and security solutions for externally exposed servers.