Larva-26009

Larva-26009 is an intrusion cluster associated with attacks on exposed MS-SQL servers that combine unauthorized remote access, persistence, post-compromise tooling, and cryptocurrency mining. Observed operations culminated in deployment of XMRig CoinMiner, but the actor also established multiple mechanisms for sustained control of compromised systems, indicating activity beyond simple opportunistic mining. Documented tradecraft includes abuse of MS-SQL server command execution to download additional payloads, installation of web shells on IIS servers, and use of remote administration and tunneling tools such as VShell, GotoHTTP, Chrome Remote Desktop, Cloudflared, and SoftEther VPN. SoftEther was configured in cascade mode, consistent with use of compromised hosts as relay or layered command-and-control infrastructure. The actor also created hidden backdoor user accounts to preserve access and support remote administration. Post-compromise behavior attributed to Larva-26009 includes attempted credential access through registry hive dumping and use of browser data theft tooling, privilege-escalation activity using multiple Potato-family tools, internal network scanning with Fscan, and in-memory execution of payloads through encrypted loaders and patched legitimate binaries. VShell usage provided remote command execution and file-management capability, while web shells and tunneling components supported persistence and covert control. Overall, Larva-26009 demonstrates a blend of initial access against internet-facing database infrastructure, defense evasion, persistence, credential theft, privilege escalation, reconnaissance, and cryptomining-oriented monetization.