Malware

SQL Slammer

SQL Slammer, also known as Sapphire, was a rapidly propagating network worm that emerged in January 2003. It exploited a buffer-overrun vulnerability in the Microsoft SQL Server 2000 Resolution Service, affecting SQL Server 2000 and Microsoft Desktop Engine 2000 systems that exposed UDP port 1434. The worm used randomized scanning to find and infect further vulnerable hosts, doubling its infected population approximately every 8.5 seconds and reaching most vulnerable systems within roughly 10 minutes. SQL Slammer did not deploy a destructive payload; its exceptionally high-volume scanning saturated networks and caused widespread denial-of-service conditions and major Internet disruption. It targeted Microsoft SQL Server deployments on Windows systems. A patch addressing the exploited vulnerability had been available before the outbreak.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

"SQL Slammer" and "TCP sequence prediction attack" are listed among linked security incident topics; SQL Slammer is historically associated with SQL Server exploitation.

Execution

1 technique

T1203Exploitation for Client ExecutionEvidence1

By sending a carefully crafted packet to the Resolution Service, an attacker could cause portions of system memory (the heap in one case, the stack in the other) to be overwritten. Overwriting it with carefully selected data could allow the attacker to run code in the security context of the SQL Server service.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

These techniques can be in the form of exploits and code injections to execute malicious code directly in memory, storing scripts in registry, and executing commands via legitimate tools.

Stealth

1 technique

T1055Process InjectionEvidence1

These techniques can be in the form of exploits and code injections to execute malicious code directly in memory, storing scripts in registry, and executing commands via legitimate tools.

Discovery

1 technique

T1046Network Service DiscoveryEvidence1

SQL Slammer did not even have a malicious payload; it just deluged networks with scans. Less than 10 minutes after being released, it scanned over 90 percent of the entire internet, essentially infecting all vulnerable machines.

Lateral Movement

1 technique

T1210Exploitation of Remote ServicesEvidence2

“WannaCry used an exploit in SMB... This enabled it to spread from network to network, as well as between computers within a network, entirely autonomously.”

Command and Control

1 technique

T1572Protocol TunnelingEvidence1

A second kind of covert channel, aimed at subverting firewall–based filtering, uses standard ports for passing non-standard traffic.

Impact

2 techniques

T1498Network Denial of ServiceEvidence1

A second kind of covert channel, aimed at subverting firewall–based filtering, uses standard ports for passing non-standard traffic. Firewalls that enforce a “block-all-but-necessary” approach to regulating traffic are the typical targets of standard port abuse. A recent (25 Jan 2003) case of standard port abuse involved a Denial of Service (DOS) attack that was variously known as the ‘SQL Slammer’ worm, ‘Sapphire’ and “SQL-Hell’.

T1498.001Direct Network FloodEvidence1

The infected host starts transmitting 376 byte long UDP packets at a very high rate to random IP addresses on the Internet thereby generating overwhelming traffic.

ACTIVITY FEED

Recent activity

28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

28 SOURCESView more in app

malwaretech blogNews

Sep 3, 2026

Machine Speed is a lie: stop trying to fight AI with AI

Rapidly propagating worm cited as having doubled infected hosts every 8.5 seconds and infected nearly every vulnerable system in under 10 minutes.

lawfareNews

Jul 15, 2026

Driven by AI, the Future of Cybersecurity Will Resemble the Past | Lawfare

Internet worm that rapidly spread by scanning vulnerable systems at massive scale, causing widespread network disruption rather than delivering a traditional malicious payload.

dark readingNews

Jun 5, 2026

Adaptive, Agentic AI Worms Loom as Next Enterprise Threat

A fast-spreading Internet worm cited as an example of flash-worm-style propagation, infecting 90% of its hosts in less than 10 minutes.

upwind blogNews

Apr 22, 2026

Why AI Security Is Repeating Every 1990s Mistake - Upwind

A notorious internet worm mentioned as part of the sequence of disruptive malware incidents that forced changes in defensive strategy.

+17 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SQL Slammer