Microsoft’s documentation says xp_cmdshell is disabled on new SQL Server installations and should stay off in most cases. Some older applications still depend on it, but the company recommends switching it on only while a required task is running. Commands issued through the feature inherit the security permissions of the SQL Server service account, and Microsoft advises restricting access to highly privileged users or using a less-privileged proxy account when non-administrators need it. The company also warns that enabling or using xp_cmdshell can trigger audit tools.
From that shell, a downloader retrieves two payloads from an attacker-controlled server:
-
MicrosoftEdgeUpdate.exe — the mining component, which uses the machine’s CPU to mine Monero through XMRig. Its configuration contains a wallet address and three mining pool addresses.
-
winlogon.exe — a Gh0st RAT variant with keylogging, file management and remote command functions. Screen capture and remote desktop are supplied through plugins that were not present in the sample analyzed.
Persistence comes from registry entries, a Windows service and scheduled tasks. The RAT’s scheduled task runs every 30 minutes, according to Zhang’s analysis. Researchers examined the RAT without connecting to a live command server because that infrastructure had already been taken offline before analysis.
Both outlets describe the same two payloads and the same xp_cmdshell abuse vector. Crypto.news adds the detail that the RAT sample was never connected to a command server; PANews, citing Crypto Briefing, states plainly that the campaign has not been attributed to a specific actor — a point Crypto.news makes by noting the publication does not identify the attackers.
Why it matters
Exposed databases remain one of the cheapest ways for attackers to acquire processing power, and this campaign shows the same server can serve two purposes at once: quiet mining revenue and a persistent foothold for data theft. The payload naming is the giveaway — a program labeled as an Edge updater on a database server has no ordinary reason to be there.
The pattern is familiar. In July 2024, attackers used vulnerable file-sharing servers to spread Monero miners and remote-access malware, with AhnLab documenting XMRig, XenoRAT and Gh0stRAT installations on Rejetto HTTP File Server and at least four attackers, including the LemonDuck group. In August 2026, Apple patched a macOS flaw after Screen Sharing was exploited to install Monero miners, and the Netherlands’ National Cyber Security Centre confirmed intrusions on multiple systems in an Aug. 12 advisory. A January 2025 CrowdStrike recruitment scam also delivered XMRig through a fake job-application download. Each case ends the same way for the host: someone else’s electricity bill and someone else’s control.
What to watch
FortiGuard Labs has not published a victim count or named the operators, so the next meaningful data point will be whether other security firms corroborate the campaign and attach a number to it. Microsoft’s guidance to keep xp_cmdshell disabled unless a specific task requires it remains the practical control for database administrators in the meantime.
Market snapshot
Monero ($XMR) traded at $535 (₹50,435) on Nov. 14, 2026, up 0.3% over 24 hours but down 12.6% over seven days, with a market cap of $10.08B and 24-hour volume of $115.5M, according to CoinPaprika data timestamped 12:38 UTC. Bitcoin stood at $67,196 (₹6,334,264), down 2.9% on the day and 11.4% on the week. The figures are market data, not a forecast, and the market is volatile and uncertain; this is not financial advice.
The campaign’s economics depend on mining quietly on hosts the operators do not own, which is why detection usually comes from server administrators noticing CPU load rather than from the blockchain itself. FortiGuard’s report, published five weeks after the activity was first spotted, leaves the size of the operation an open question for now.
bitcoinworld.co.in
