Skip to main content
عربي
logo

NCSC-TAD-2202-002

Severity Level: High
Malware

Reference No.: NCSC-TAD-2202-002CVSS 0

Attackers Target MS-SQL Servers with Cobalt Strike

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Threat actors are targeting internet-facing Microsoft SQL servers by scanning for open TCP port 1433 and performing brute-force attacks against administrator accounts with weak passwords. After gaining access, the attackers deploy cryptocurrency miners and Cobalt Strike for persistence and lateral movement. To evade detection, they inject Cobalt Strike into “MSBuild.exe”, followed by a beacon into the Windows library “wwanmm.dll” to receive commands from the threat actor.

Affected Technologies

  • Microsoft SQL servers

Mitigation and Immediate Actions

  1. 01

    Use a strong admin password.

  2. 02

    Place the server behind the firewall.

  3. 03

    Monitor suspicious activities.

  4. 04

    Apply available security updates.

  5. 05

    Use a data access controller to inspect and enforce policies on every transaction.

References