Loading story…
AhnLab said the Larva-26002 threat actor is continuing a multi-year campaign against poorly secured, internet-exposed Microsoft SQL Server systems, shifting from direct ransomware deployment to using compromised servers as part of a broader scanning operation. The group previously deployed Trigona and Mimic ransomware, abused the legitimate BCP utility to reconstruct malware from database contents, and installed remote access tools including AnyDesk, Teramind, and port-forwarding utilities. Researchers said the actor has repeatedly targeted servers with weak credentials and has continued to revisit previously compromised systems.
In the latest activity, the actor deployed the Go-based ICE Cloud malware family, including ICE Cloud Launcher and ICE Cloud Client, to authenticate with a command-and-control server, receive MSSQL scanning assignments, brute-force target servers with supplied credentials, and report successful logins back to the operator. AhnLab linked the campaign to earlier Mimic-related activity through Turkish-language strings and recurring artifacts such as the table name uGnzBdZbsi and format file FODsOZKgAU.txt, indicating continuity in tooling and tradecraft. The campaign suggests the group is building a distributed infrastructure to identify vulnerable database assets at scale, while defenders are being urged to strengthen passwords, rotate credentials, update security software, and restrict public database access with firewall controls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
ASEC reported that Turkish-language strings in ICE Cloud, along with recurring artifacts such as the table name "uGnzBdZbsi" and format file "FODsOZKgAU.txt," align the 2026 campaign with earlier Mimic-related operations attributed to Larva-26002. This provided new technical details supporting continuity in the actor's tooling and tradecraft.
In 2026, Larva-26002 was observed using a Go-based malware family called ICE Cloud, including ICE Cloud Launcher and ICE Cloud Client, to authenticate to a C2 server, receive MSSQL scanning tasks, brute-force targets with supplied credentials, and report successful logins. The activity targeted improperly managed internet-exposed MS-SQL servers, including previously compromised systems, marking a move toward distributed scanning infrastructure rather than immediate ransomware deployment.
During 2025, the threat actor continued compromising exposed MS-SQL servers and added Teramind to its toolset. Reporting also links the group to use of a Rust-based scanner, indicating an expansion from ransomware deployment toward broader scanning and post-compromise operations.
In 2024, Larva-26002 began attacking poorly secured internet-exposed Microsoft SQL servers by abusing weak credentials. The actor deployed Trigona and Mimic ransomware, used the legitimate BCP utility to reconstruct malware on disk, and installed remote access tooling such as AnyDesk and port forwarders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026
A targeted attack on an **MS-SQL server** led to the deployment of **XMRig CoinMiner** along with multiple remote-access tools, according to AhnLab ASEC. The intrusion was attributed to the **Larva-26009** threat actor, which went beyond the common pattern of opportunistic cryptomining on exposed SQL servers by also installing **VShell**, **GotoHTTP**, and **SoftEther VPN** to maintain control over the compromised system. The toolset indicates the attackers sought both monetization and persistent remote administration after the initial compromise. While coin miners are frequently observed in attacks against internet-exposed **Microsoft SQL Server** instances, the addition of tunneling and remote-management software suggests a more deliberate post-compromise operation designed to preserve access and expand attacker control over the victim environment.
Jul 29, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026