Attackers Target MS-SQL Servers with Cobalt Strike

Threat actors are targeting internet-facing Microsoft SQL servers by scanning for open TCP port 1433 and performing brute-force attacks against administrator accounts with weak passwords. After gaining access, the attackers deploy cryptocurrency miners and Cobalt Strike for persistence and lateral movement. To evade detection, they inject Cobalt Strike into “MSBuild.exe”, followed by a beacon into the Windows library “wwanmm.dll” to receive commands from the threat actor.