[Hackers Hijack Microsoft SQL Server to Deploy Gh0st RAT and Monero Mining Program] According to Crypto Briefing, FortiGuard Labs disclosed an attack campaign targeting Microsoft SQL Server databases exposed on the internet. Attackers exploited weak passwords and misconfigurations to brute-force infiltrate the server, enabling the xp_cmdshell feature and implanting two malicious payloads: a Monero mining program disguised as MicrosoftEdgeUpdate.exe, and a Gh0st RAT variant supporting keylogging and screenshots. Both payloads achieved persistence by modifying the registry and scheduled tasks. FortiGuard Labs stated that the campaign has been active since at least early October 2026; the number of victims has not yet been confirmed, and the attack has not been attributed to any specific actor.