According to CoinMeta, security research firm Fortiguard Labs has revealed that since early October 2026, hacker groups have been continuously scanning Microsoft SQL Server databases exposed on the public internet, using a dictionary containing over 2,700 common weak passwords to carry out brute-force attacks. After successful intrusion, the attackers gained control of the underlying operating system by executing malicious T-SQL commands, and implanted a Monero mining program disguised as MicrosoftEdgeUpdate, as well as a Gh0st RAT remote access Trojan variant that supports over 30 types of commands. This Trojan possesses functions such as keylogging, screen capturing, remote desktop control, and theft of QQ credentials. It achieves persistent residency by modifying the registry and creating scheduled tasks.