Loading story…
Attackers have been distributing the Gh0stCringe remote access trojan, also tracked as CirenegRAT, through vulnerable MS-SQL and MySQL database servers exposed to brute-force attacks, dictionary attacks, or exploitation of unpatched flaws. The malware is linked to the same poorly secured server ecosystem that has also seen infections from KingMiner and Vollgar, indicating continued abuse of internet-facing database infrastructure for malware deployment and persistence.
Gh0stCringe is a feature-rich backdoor derived partly from the leaked Gh0st RAT source code and supports keylogging, host reconnaissance, payload download and execution, clipboard theft, modular proxy or plugin loading, and even MBR destruction. It uses a custom command-and-control protocol identified by the signature string xy , gathers detailed host and security-product information, stores XOR-encoded keystrokes in %SystemDirectory%\Default.key, and has been detected by AhnLab V3 as Backdoor/Win.Gh0stRAT variants.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Gh0stCringe, also known as CirenegRAT, was first discovered in December 2018 according to the AhnLab report.
AhnLab reported observing Gh0stCringe being distributed to vulnerable MS-SQL and MySQL database servers, with logs tied to sqlservr.exe and MySQL server processes on Windows. The activity was assessed as targeting poorly managed database servers with weak credentials or unpatched vulnerabilities.
Before the database-server activity described in the report, Gh0stCringe had been known to spread through an SMB vulnerability using the ZombieBoy SMB exploitation tool.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have been targeting poorly secured, internet-exposed **Microsoft SQL Server** instances to deliver **Mimic** and **Trigona** ransomware, using brute-force or weak credentials and, in some cases, `xp_cmdshell` for command execution. Researchers reported that one actor used the SQL Server **Bulk Copy Program (BCP)** utility to rebuild malware from database contents onto disk, while other intrusions relied on PowerShell download cradles, mounted SMB shares, and remote access tools including **AnyDesk**. In multiple cases, the attackers established persistence, created administrator accounts, enabled credential theft opportunities such as the `WDigest\UseLogonCredential` registry setting, and deployed tooling including **Mimikatz**, **PsExec**, **Advanced Port Scanner**, **Defender Control**, and **SDelete**.
Aug 14, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026
AhnLab said the **Larva-26002** threat actor is continuing a multi-year campaign against poorly secured, internet-exposed **Microsoft SQL Server** systems, shifting from direct ransomware deployment to using compromised servers as part of a broader scanning operation. The group previously deployed **Trigona** and **Mimic** ransomware, abused the legitimate **BCP** utility to reconstruct malware from database contents, and installed remote access tools including **AnyDesk**, **Teramind**, and port-forwarding utilities. Researchers said the actor has repeatedly targeted servers with weak credentials and has continued to revisit previously compromised systems. In the latest activity, the actor deployed the Go-based **ICE Cloud** malware family, including **ICE Cloud Launcher** and **ICE Cloud Client**, to authenticate with a command-and-control server, receive MSSQL scanning assignments, brute-force target servers with supplied credentials, and report successful logins back to the operator. AhnLab linked the campaign to earlier Mimic-related activity through Turkish-language strings and recurring artifacts such as the table name `uGnzBdZbsi` and format file `FODsOZKgAU.txt`, indicating continuity in tooling and tradecraft. The campaign suggests the group is building a distributed infrastructure to identify vulnerable database assets at scale, while defenders are being urged to strengthen passwords, rotate credentials, update security software, and restrict public database access with firewall controls.
Jun 29, 2026