Tag: ms-sql

2 Attack Reports | 0 Vulnerabilities

Attack reports

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell…
malware
apt
china
botnet
sqlshell
irc
windows servers
miner
ms-sql
2025-05-27
credentialstealer
maggiescan
detofin
upm
pemodifier
sqldoor
maggie
wgdrop
shaduser
asia-pacific
Published: May 27, 2025
Downloadable IOCs: 13

Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malw…
privilege escalation
brute force
2025-04-22
ms-sql
wget
remote control
petitpotato
dictionary attack
ammyy admin
Published: April 22, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports