Weak Passwords, Strong Profits: Monero Mining Campaign Exploits Public SQL Servers
TREE NEWS reports: Security researchers at FortiGuard Labs have disclosed an ongoing campaign in which a threat actor has been scanning internet-exposed Microsoft SQL Server databases and brute-forcing access using a dictionary of more than 2,700 common weak passwords. Once inside, the attackers deploy a Monero (XMR) cryptocurrency miner alongside the Gh0st RAT remote access trojan, turning compromised database servers into silent, persistent mining nodes while retaining hands-on control of the host.
The campaign has reportedly been active since at least early October 2026, and its choice of targets is telling. Public-facing SQL Server instances are among the most abundant and least glamorous pieces of enterprise infrastructure on the internet — frequently stood up by application teams, rarely hardened, and almost never monitored for outbound mining traffic. That combination makes them an attractive, low-cost resource for attackers seeking compute without paying for it.
Why Monero Remains the Miner’s Coin of Choice
Monero’s design continues to make it the default currency for cryptojacking operations. Its CPU-friendly RandomX proof-of-work algorithm allows attackers to mine profitably on general-purpose server hardware rather than requiring ASICs or GPUs, while its privacy features complicate tracing of payouts. For an attacker who has already compromised a host, the marginal cost of installing a miner is near zero, and the revenue accrues continuously for as long as the intrusion goes undetected.
- Low barrier to entry: RandomX rewards ordinary x86 server CPUs, which SQL Server hosts typically have in abundance.
- Privacy: Ring signatures and stealth addresses obscure the flow of mined funds.
- Dual payload: Pairing a miner with Gh0st RAT suggests the actor may monetize access in multiple ways, including resale or lateral movement.
Implications for the Broader Crypto Ecosystem
Cryptojacking is often dismissed as a nuisance rather than a serious threat, but it carries real consequences for the industry. Illicit mining inflates network hash rates in ways that distort economic analysis, consumes energy that enterprises pay for unknowingly, and — most importantly — fuels a narrative that cryptocurrency infrastructure is inherently tied to criminal activity. That narrative has been repeatedly invoked by regulators and legislators weighing restrictions on mining operations and on privacy-focused assets specifically.
The dual-payload nature of this campaign also deserves attention. Gh0st RAT provides persistent remote access, meaning the Monero miner may be only the visible symptom of a deeper compromise. Organizations that discover mining software on a database server should treat the host as fully breached rather than simply deleting the miner.
What Comes Next
Expect FortiGuard and other security vendors to expand signature coverage for this specific miner family and password dictionary. More consequentially, the disclosure is likely to accelerate two trends: broader adoption of automated database hardening and password-policy enforcement, and increased scrutiny of outbound network traffic from database tiers, which should never legitimately connect to mining pools. For the crypto industry, the episode is a reminder that privacy coins’ legitimate use cases remain entangled with their attractiveness to abusers — a tension that will keep Monero in regulators’ crosshairs even as defenders work to close the door on brute-force intrusions.
