Attackers Brute-Forced an MSSQL Administrator Account to Compromise a Customer Server
Summary
An MSP found that attackers had brute-forced a customer’s MSSQL administrator password, installed backdoors and persistence, and downloaded post-exploitation tools. The team contained the compromise before business disruption.
Key points
- NTConnections investigated a customer’s SQL Server outage and found multiple attacker footholds on the server.
- The attackers gained access by brute-forcing the database administrator (SA) password.
- They disabled a firewall-affiliated service, downloaded obfuscated backdoors over FTP, and created persistence.
- They deleted MSSQL and Windows event logs and downloaded cryptocurrency-mining software and tools to inhibit antivirus.
- NTConnections and Huntress investigated the intrusion timeline and possible data exfiltration, then used remediation recommendations and backup services to address the compromise.
- The article says the customer avoided business interruption; it does not state whether data was exfiltrated.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- MSSQL server compromise following brute-force access to the administrator (SA) account, with backdoors, persistence, and post-exploitation activity
- Operational Impact
- The SQL Server had failed and was restored. The customer was able to continue business without interruption after remediation; data exfiltration was investigated, but the article does not report whether any occurred.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1070.001 · Clear Windows Event LogsThe attackers deleted MSSQL and Windows event logs to cover their tracks.T1071.002 · File Transfer ProtocolsThe attackers downloaded obfuscated backdoors over FTP.T1110 · Brute ForceAttackers brute-forced the database administrator (SA) password to gain access.T1547 · Boot or Logon Autostart ExecutionThe attackers created persistence mechanisms for long-term access; the specific mechanism is not identified.