T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers
T-SQL Being Abused to Deliver Malware on Compromised MS SQL Servers
In early October 2026, FortiGuard Labs uncovered an active campaign specifically targeting Internet-facing Microsoft SQL Server instances. This campaign is notable for its use of T-SQL commands to deliver malware. The malware first scans IP ranges for exposed SQL Servers and then attempts to log in using supplied credentials. Following a successful login, it remotely executes malicious T-SQL commands on the compromised server to download and run additional malware.
The full attack chain has been detailed, outlining how the malware retrieves the IP ranges to scan, downloads supporting files, establishes persistence, and abuses specific T-SQL commands to deliver the next stage of the attack. The infection chain proceeds as follows:
- dllhost.exe
- ip.php (target IP range for MS SQL Server)
- Naabu port scan (TCP Port 1433)
- go.vbs / go.bat
- dwm.exe brute force
- T-SQL execution (2018.sql)
- download and run additional malware.
Regarding the malware payload analysis, the discovered payload, named dllhost.exe, is packed with UPX (versions 3.9-5.21 detected). This specific payload, written in Go, embeds the open-source Naabu project (v2), a tool that enables fast port scanning, including TCP SYN scans. Furthermore, the malware downloads several supporting files, which include 2018.sql, dwm.exe, go.bat, go.vbs, out.bat, user.txt, pass.txt, and sqlcmd.exe, from its file server to the local %Temp% folder for later execution.