Loading story…
A threat actor exploited an SQL injection flaw in a web page at a technology-sector organization, compromising an endpoint running IIS and Microsoft SQL Server and then carrying out extensive post-exploitation activity. Huntress reported the attacker used base64-encoded PowerShell for payload delivery, ran reconnaissance including tasklist /svc, and exfiltrated process information to an OAST domain. The actor then enabled Remote Desktop Services, created a new local administrator account named adminweb2$, and attempted to disable Windows Defender to retain access and reduce detection.
The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known BadIIS modules using appcmd.exe, downloaded the XMRig cryptocurrency miner, hid miner-related files with attrib.exe, and used nssm.exe to keep the miner running persistently. Additional payloads included PowerShell and batch files such as qdcjoke1.2.ps1, c_joke1.2.ps1, and qd_tjoke.bat, along with CnCrypt Protect, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Huntress published a report detailing the June 26 intrusion, including the SQL injection vector, post-compromise persistence steps, BadIIS installation, XMRig deployment, and additional payloads such as PowerShell scripts, batch files, and CnCrypt Protect.
Following the SQL injection compromise, the actor used base64-encoded PowerShell, performed reconnaissance, enabled Remote Desktop Services, created a local administrator account named adminweb2$, attempted to disable Windows Defender, installed BadIIS modules, and deployed XMRig with persistence via nssm.exe.
On June 26, a threat actor exploited an SQL injection flaw in a web page hosted on an endpoint running IIS and Microsoft SQL Server at a technology-sector organization, gaining initial access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor repeatedly exploited or attempted to exploit a vulnerable Adobe ColdFusion server, then used IIS worker process `w3wp.exe` to run reconnaissance and deploy multiple steganographic webshells, including `UA4fp7R.aspx` and `WRBYTR5750images.aspx`. Huntress reported the intruder embedded the marker **ONEPIECE** in shell logic and maintained persistence across repeated restoration attempts, indicating the server was returned to production before remediation was complete. The intrusion escalated into broad defense impairment designed to preserve access and obstruct responders. The actor timestomped files, disabled IIS logging and Microsoft Defender, killed security and logging tools, removed the ModSecurity IIS module, and used Image File Execution Options debugger registry entries to neutralize Sysmon and Filebeat. The attacker also weakened credential protections by enabling `WDigest` `UseLogonCredential`, exported ODBC registry data, and used Mimikatz-style credential dumping to write passwords and hashes to files before Huntress disrupted the operation prior to data theft or ransomware deployment.
Jul 2, 2026
Attackers turned a single **ClickFix** social-engineering lure into a multi-stage Windows intrusion that abused `pcalua.exe` to launch `mshta.exe`, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving **EtherHiding** infrastructure and **GULoader**, while Huntress documented a related intrusion in which an MSI dropped **Potemkin**, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called **RMMProject** entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading. The operators then established persistence with Run keys, scheduled tasks, and a renamed **Cloudflare Tunnel**, and deployed **EtherRAT**, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy **Chisel** reverse SOCKS tunnels, and used **WinRM**, **WMIExec**, and **SMBExec** for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Jul 12, 2026
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026