Vollgar botnet has managed to infect around 3k MSSQL DB servers daily

Cybersecurity researchers spotted a crypto-mining botnet, tracked as Vollgar, that has been hijacking MSSQL servers since at least 2018.

Researchers at Guardicore Labs discovered a crypto-mining botnet, tracked as Vollgar botnet, that is targeting MSSQL databases since 2018. The botnet is used to launch brute-force attacks against MSSQL databases to take over servers and install Monero and Vollar cryptocurrency miners.

The botnet was first spotted in May 2018, when it was that targeting Windows machines running MS-SQL servers to deploy a broad range of malware, including RAT and miners.

“Guardicore Labs team has recently uncovered a long-running attack campaign which aims to infect Windows machines running MS-SQL servers.” reads the analysis published by Guardicore.

“Dating back to May 2018, the campaign uses password brute force to breach victim machines, deploys multiple backdoors and executes numerous malicious modules, such as multifunctional remote access tools (RATs) and cryptominers. We dubbed the campaign Vollgar after the Vollar cryptocurreny it mines and its offensive, vulgar behaviour.”

The botnet targets MS-SQL servers exposed online with weak credentials, according to the experts, attackers managed to successfully infect nearly 2,000-3,000 installs per day over the past few weeks.