Malicious users are targeting Microsoft SQL and MySQL database servers to deploy the Gh0stCringe remote access trojan on vulnerable devices.
See also: MySQL: Replaces terms that reinforce racial discrimination
Gh0stCringe, also known as CirenegRAT , is a variant of the Gh0st RAT malware that was most recently developed by Chinese cyberespionage operations in 2020, but dates back to 2018.
According to cybersecurity firm AhnLab, researchers describe how the threat actors behind GhostCringe target unsecured database servers with weak account credentials and no supervision.
Malicious actors compromise the servers and use the mysqld.exe, mysqld-nt.exe , and sqlserver.exe to write the malicious executable "mcsql.exe" to disk.
These attacks are similar to the Microsoft SQL Server attacks detected last February, which dropped Cobalt Strike beacons.
In addition to Gh0stCringe, AhnLab's research also reports the presence of multiple malware samples on the servers under investigation, indicating that competing threat actors are compromising the same servers to drop payloads for their own campaigns.
Gh0stCringe RAT is a powerful malware that establishes a connection to the C2 server to receive custom commands or infiltrate stolen information.
See also: Chinese hacker group APT-27 launched 15,000 attacks on MySQL Servers
Malware can be configured during development with specific settings related to its functions, such as:
- Self-replication
- Execution method
- Change file size
- Analysis interruption technique
- Keylogger
- Ending the Rundll32 process
- Self-copying file property
Of the above, the keylogger is perhaps the most aggressive element, as this is what steals user inputs from the compromised system.
See also: Microsoft turns Teams and Outlook into hybrid work-friendly tools
How will you protect yourself?
First, update your server software to apply the latest available security patches, which help block a range of attacks that exploit known vulnerabilities.
It is also essential to use a strong administrator password that is difficult to guess or crack via a brute force.
The most critical step is to place the database server behind a firewall that allows only authorized devices to access the server.
Finally, monitor all actions to detect suspicious identification activity and use a data access controller to inspect the data transaction policy.
