Summary:
MS-SQL servers with weak passwords and open access to the internet are frequently targeted by threat actors. They exploit these servers by scanning for vulnerabilities and using brute force or dictionary attacks to gain admin privileges. Once access is obtained, threat actors employ methods like the xp_cmdshell command, OLE Stored Procedure, or MS-SQL Agent Jobs to execute malicious commands and install malware. Researcher has reported a significant number of malware instances called CLR Shell (SqlShell), which are CLR Stored Procedure DLLs used during the installation of other malware like ransomware and CoinMiner. These malware variants can execute commands, download/upload files, escalate privileges, and act as downloaders for additional malware from specific URLs.[/subscribe_to_unlock_form]
Summary:
MS-SQL servers with weak passwords and open access to the internet are frequently targeted by threat actors. They exploit these servers by scanning for vulnerabilities and using brute force or dictionary attacks to gain admin privileges. Once access is obtained, threat actors employ methods like the xp_cmdshell command, OLE Stored Procedure, or MS-SQL Agent Jobs to execute malicious commands and install malware. Researcher has reported a significant number of malware instances called CLR Shell (SqlShell), which are CLR Stored Procedure DLLs used during the installation of other malware like ransomware and CoinMiner. These malware variants can execute commands, download/upload files, escalate privileges, and act as downloaders for additional malware from specific URLs.[emaillocker id="1283"]
While an admin account in MS-SQL grants control over the database servers, it does not provide direct control over the Windows operating system. However, there are features within MS-SQL that allow the execution of OS commands, and if an admin account enables these settings, control over the Windows OS can be achieved. One such feature is xp_cmdshell, which executes commands in the Windows shell. Malware like LemonDuck utilizes xp_cmdshell to download additional malware and can even re-register it if it's disabled. Another method involves exploiting OLE Stored Procedures to execute other applications, including malicious commands or malware. This feature needs to be enabled, similar to xp_cmdshell. MS-SQL Agent Jobs is another avenue used by threat actors to register tasks that execute Windows commands.
SqlShells are a type of malware that are used in attacks against poorly managed MS-SQL servers. They provide basic features such as command execution and file download and are often used to install additional malware during attack processes. SqlShells are capable of a broad range of features, and the more features they have, the easier it becomes for threat actors to perform malicious behaviors such as malware installation. SqlShells are specifically designed for installing CoinMiners. Examples include SqlShells used in the distribution of MrbMiner, MyKings CoinMiner, LoveMiner, and proxyware. These SqlShells serve as downloaders or droppers for the CoinMiner payloads, and they may include features like downloading files, executing shellcode, and configuring mining pool settings.
SqlShell malware is being installed on poorly managed MS-SQL database servers, which can lead to the installation of additional malware and the execution of malicious commands. Brute force and dictionary attacks are common on poorly managed accounts, and these servers are often installed during the installation process of ERP and business solutions. Administrators should use strong and periodically changing passwords, update to the latest patches, and use security programs such as firewalls to restrict access from outside.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/05/clr-sqlshell-malware-targets-ms-sql.html
[/emaillocker]