Threat Actors Target Microsoft SQL Servers in Mimic Ransomware Attacks

For several weeks, threat actors have been targeting insecure Microsoft SQL database servers (MSSQL) of organizations based in the U.S., EU and Latin America, in order to deploy ransomware.

In the ongoing campaign, observed by researchers with Securonix, attackers first brute force administrative passwords on MSSQL servers in order to download a number of payloads, steal credentials, perform lateral movement across the network and eventually download ransomware. Researchers also believe that threat actors have been selling their access to various …

america attackers attacks brute campaign database deploy insecure latin america microsoft microsoft sql microsoft sql servers mimic mssql mssql servers order organizations passwords ransomware ransomware attacks researchers securonix servers sql sql database sql servers target targeting threat threat actors