{"id":38090,"date":"2022-11-15T18:50:07","date_gmt":"2022-11-15T15:50:07","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=38090"},"modified":"2026-03-28T02:14:10","modified_gmt":"2026-03-27T23:14:10","slug":"reoccurring-attacks-using-microsoft-sql-server-rise-by-56-in-2022","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/reoccurring-attacks-using-microsoft-sql-server-rise-by-56-in-2022\/","title":{"rendered":"Reoccurring attacks using Microsoft SQL Server rise by 56% in 2022<\/strong>"},"content":{"rendered":"\n

Attacks using Microsoft SQL Server increased by 56% In September 2022 compared to the same period last year. Perpetrators are still using a common attack employing SQL Server to attempt to gain access to corporate infrastructures. The technical details\u00a0of one of these incidents\u00a0were analyzed in Kaspersky\u2019s new Managed Detection and Response\u00a0report<\/a>.<\/p>\n\n\n\n

Microsoft SQL Server is used worldwide by corporations, medium and small businesses for database management.\u00a0Kaspersky researchers found an increase in attacks that utilize Microsoft SQL Server\u2019s processes. In September 2022, the number of SQL servers hit amounted to more than 3,000 units, growing by 56% compared to the same period last year. These attacks were successfully detected by Kaspersky Endpoint Security for Business and Managed Detection and Response.<\/p>\n\n\n\n

The number of these attacks have been increasing gradually over the past year and have stayed above 3000 since April 2022, except for a slight decrease in July and August.<\/p>\n\n\n\n

\u201cDespite <\/em>Microsoft SQL Server\u2019s popularity, companies may not be giving sufficient priority to protect against threats associated with the software. Attacks using malicious SQL Server jobs have been known for a long time, but it is still used by perpetrators to gain access to a company\u2019s infrastructure<\/em>,\u201d said Sergey Soldatov, Head of Security Operations Center at Kaspersky. <\/p>\n\n\n\n

A peculiar incident: PowerShell scripts and .PNG files<\/strong><\/strong><\/p>\n\n\n\n

In the new report, devoted to the most interesting Managed Detection and Response incidents, Kaspersky experts describe is an attack employing Microsoft SQL Server jobs \u2013 a sequence of commands executed by the server agent. <\/p>\n\n\n\n

\u201cAttackers attempted to modify the server configuration to gain access to the shell to run malware via PowerShell. The compromised SQL Server was trying to run malicious PowerShell scripts that generated a connection to external IP addresses. This PowerShell script runs the malware disguised as .png files from that external IP address using the “MsiMake” attribute, which is very similar to the behavior of PurpleFox malware<\/em>\u201d, explained Mr. Soldatov. <\/p>\n\n\n\n

An example of SQL jobs containing obfuscated PowerShell commands<\/em><\/em><\/p>\n\n\n\n

To read the full Managed Detection and Response report, please visit\u00a0Securelist.com<\/a>.\u00a0<\/p>\n\n\n\n

To protect against threats targeting businesses, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n