Loading story…
The Kingminer botnet has been repeatedly observed compromising publicly exposed Microsoft SQL Server instances by brute-forcing weak credentials on TCP port 1433, then deploying cryptocurrency miners and follow-on tooling. Researchers linked these intrusions to opportunistic campaigns that install customized XMRig miners, use downloader scripts and fileless PowerShell execution, and in some cases deliver Cobalt Strike beacons for persistence and post-compromise control. Investigations also found payload staging through GitHub, abuse of legitimate Windows binaries including MSBuild.exe, rundll32.exe, control.exe, and main.cpl, and injection into trusted processes such as wwanmm.dll to reduce detection.
Threat reports describe Kingminer as a moderately sophisticated criminal botnet that combines public offensive tools with custom malware components, including reflective loading, DLL side-loading, and credential theft capabilities derived from tools such as Mimikatz. In one investigated intrusion, sqlservr.exe launched an obfuscated VBScript that downloaded a standalone PowerShell binary and executed additional scripts in memory before starting a miner. The malware also checked systems for BlueKeep-related hotfixes KB4499175 and KB4500331 and disabled RDP on vulnerable hosts, apparently to block competing botnets from exploiting the same machines. Defenders were advised to enforce strong SQL passwords, restrict internet exposure, patch public-facing services, and improve logging and monitoring, as repeated attack attempts stopped once the underlying weakness was remediated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro’s Managed XDR team investigated a Kingminer attack against a client’s exposed Microsoft SQL Server, tracing an infection chain from sqlservr.exe to obfuscated VBScript, GitHub-hosted PowerShell tooling, in-memory payload execution, and a cryptocurrency miner. The investigation also found BlueKeep hotfix checks and logic to disable RDP on vulnerable legacy Windows systems.
AhnLab ASEC observed a new wave of attacks against publicly exposed Microsoft SQL Servers with weak passwords, where attackers brute-forced access, installed Cobalt Strike, and dropped coin miners including KingMiner, Lemon Duck, and Vollgar. ASEC assessed that the campaign’s download and command-and-control URLs pointed to a single attacker.
Sophos reported that Kingminer was spreading primarily by brute-forcing Microsoft SQL Server credentials, while also experimenting with EternalBlue-based propagation. The report also described the botnet checking for BlueKeep-related patches and disabling RDP on vulnerable hosts to keep competing botnets out.
360 Total Security published research describing a new Kingminer cryptomining trojan variant spreading via weak-password attacks. The reference indicates this reporting occurred in late July 2019.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcetrendmicro.com
Open sourcebleepingcomputer.com
Open sourceblog.360totalsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A targeted attack on an **MS-SQL server** led to the deployment of **XMRig CoinMiner** along with multiple remote-access tools, according to AhnLab ASEC. The intrusion was attributed to the **Larva-26009** threat actor, which went beyond the common pattern of opportunistic cryptomining on exposed SQL servers by also installing **VShell**, **GotoHTTP**, and **SoftEther VPN** to maintain control over the compromised system. The toolset indicates the attackers sought both monetization and persistent remote administration after the initial compromise. While coin miners are frequently observed in attacks against internet-exposed **Microsoft SQL Server** instances, the addition of tunneling and remote-management software suggests a more deliberate post-compromise operation designed to preserve access and expand attacker control over the victim environment.
Jul 29, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026