BlueSky Ransomware Deployed After SQL Server Brute-Force Intrusion

Attackers brute-forced the sa account on an internet-facing Microsoft SQL Server and escalated a compromise into a full BlueSky ransomware deployment in about 32 minutes. After access was obtained, they enabled xp_cmdshell, launched PowerShell payloads, established a Cobalt Strike beacon, and used Tor2Mine tooling to disable antivirus, create persistence, and install an XMRig-based Monero miner. The intrusion then expanded through remote service creation and SMB activity toward domain controllers and file shares before the ransomware binary, masquerading as vmware.exe, was executed on the initial host. Files were encrypted with the .bluesky extension and a ransom note named # DECRYPT FILES BLUESKY #.txt was dropped, while investigators reported no evidence of data exfiltration.

BlueSky is a Windows-focused ransomware family observed since 2022 that has been distributed through phishing emails, phishing sites, and trojanized downloads in addition to direct server compromise. Technical analysis shows the malware adjusts privileges, hides threads from debuggers, creates a mutex, and selectively skips some system-related files and directories while targeting user and database data. It accelerates encryption across local and network resources using multithreading and Windows I/O completion ports, stores recovery-related data in the Windows registry, terminates selected processes before encryption, appends the .bluesky extension to locked files, and generates ransom notes in both TXT and HTML formats.