FortiGuard Labs: Hackers Hijack Microsoft SQL Servers to Deploy Gh0st RAT, Monero Miner

The notable detail is the pairing of a stealthy remote-access trojan with a Monero miner in a single intrusion: the miner monetizes the compromised host directly, while the RAT gives attackers persistent hands-on access, suggesting either a dual-purpose actor or a bundled toolkit sold to multiple operators. This matters most for operators of internet-exposed SQL Server instances, where weak credentials and misconfigurations remain the entry point rather than any novel exploit. With victim counts unconfirmed and no attribution, the open question is whether this is one campaign or a common playbook spreading across exposed database infrastructure.