An exposed attacker server containing an MSSQL-focused post-exploitation toolkit, credential-harvesting artifacts, and stolen material. The discovery revealed how attackers could use Microsoft SQL Server access to run commands, collect credentials, and prepare attacks against additional systems.
The staging server, located at 151.243.232.123, was publicly accessible without authentication. ThreatMon linked its contents to activity involving a Viva Aerobus-side environment between September 25 and 29, 2026.
On September 25, at 16:20, a victim-side SQL Server retrieved a payload from the infrastructure. Between 16:21 and 16:23, an unrelated external host began exploring the same server and its exposed directories.
By 18:04–18:05, additional hosts had downloaded tools and collected artifacts. This created a second exposure: material taken during the intrusion became accessible to parties beyond the original attacker.
MSSQL Toolkit Threatens Credentials
The workflow relied on xp_cmdshell, a SQL Server extended stored procedure that can execute operating-system commands when enabled. Recovered tools used SQL sessions to launch Windows commands and Base64-encoded PowerShell.
The exposed server contained 17 named post-exploitation tools. These included chrome_dump.ps1 and cred_dump.ps1 for credential extraction, cred_enum.ps1 for enumeration, and sqlspray.ps1 and mssqltest.ps1 for testing SQL credentials.
Other files included exfil.py, upload.py, vault.cmd, and vtest.ps1. Researchers also recovered Mimikatz output and directories named loot/ and loot2/.
Credential-access activity targeted Windows Credential Manager, DPAPI-protected material, and browser password stores. Recovered SQL Server Management Studio settings contained connection history, database usernames, and protected saved-password data.
These records could help attackers identify additional servers and accounts to test. However, the presence of DPAPI-protected passwords does not, by itself, establish that every saved password was successfully recovered.
The toolkit also supported file transfers through SQL query responses. It could divide files into chunks, encode them with Base64, and return the data through the existing MSSQL connection.
This approach meant a separate outbound communication channel was not always necessary to move collected information.
Researchers found collected source code and configuration files referencing SQL, OAuth, mail, SFTP, payment, and reporting integrations. Such material could expose secrets or reveal systems suitable for further targeting.
Recovered tools tested username and password combinations against additional SQL servers and checked login identity and server-role membership following successful authentication. Companion tooling tested access to SMB administrative shares.
ThreatMon assessed that some targeting information came from SSMS metadata and configuration files. The evidence supports credential harvesting, credential-reuse attempts, and lateral-movement preparation, but does not confirm successful movement into additional systems.
Indicators of Compromise
| Indicator type | Indicator | Description |
|---|---|---|
| IPv4 address | 151.243.232.123 | Exposed attacker staging and loot server |
| SHA256 | c38f49ba68b891bb476510704cddf080798f3c70075e2a517e98e04e833f64fa | Hash reported for exfil |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
