FortiGuard Labs disclosed a campaign targeting internet-exposed Microsoft SQL Server databases, deploying both a Monero cryptocurrency miner and the Gh0st Remote Access Trojan (RAT). Attackers breached servers through brute-force attacks on weak passwords and misconfigurations, then enabled the xp_cmdshell feature to install two malicious payloads. The malware includes a Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant equipped with keylogging and screen-capture capabilities. Both payloads achieve persistence by modifying Windows registry entries and scheduled tasks. The campaign has been active since at least early October 2026, though FortiGuard Labs has not confirmed the number of victims or attributed the attack to any specific threat actor.