According to CoinMeta, FortiGuard Labs reports that Monero miners and Gh0st RAT hijacked Microsoft’s SQL servers accessible over the internet, installed mining software and remote access malware, which allowed them to steal data and control the infected machines. This activity was first discovered in October 2026, and FortiGuard Labs provided a detailed description of the attack process in a report on November 12. The attackers used predefined credentials to log into the exposed databases, with a password list containing over 2,700 entries, including usernames such as “sa” and “admin”. After gaining access, the attackers ran database commands to enable xp_cmdshell and installed a downloader to retrieve Monero miners and Gh0st RAT from the servers under their control. Microsoft noted that xp_cmdshell is disabled by default in new SQL server installations and should remain turned off. The malware utilized the CPU of the infected machines to mine Monero through xmrig, with the configuration containing wallet addresses and pool addresses.