Threat Actors Continuously Attacking MS-SQL Servers to Deploy ICE Cloud Scanner
A threat actor identified as Larva-26002 has been persistently targeting inadequately managed Microsoft SQL (MS-SQL) servers, deploying a new scanner malware known as ICE Cloud Client. This campaign has been active since January 2024 and continues into…
A threat actor identified as Larva-26002 has been persistently targeting inadequately managed Microsoft SQL (MS-SQL) servers, deploying a new scanner malware known as ICE Cloud Client. This campaign has been active since January 2024 and continues into 2026, with the attackers consistently enhancing their tools. Initially a ransomware operation, the focus has shifted to large-scale scanning of vulnerable database infrastructures.
In January 2024, the group utilized Trigona and Mimic ransomware on MS-SQL servers with weak credentials. The Bulk Copy Program (BCP) utility, a legitimate MS-SQL tool, was exploited to deploy malware directly onto compromised hosts. Additional tools like AnyDesk were installed for remote access, along with port forwarders for RDP connections . By 2025, Teramind, a remote monitoring and management tool, was added, and a scanner written in Rust was implemented.
In 2026, ASEC analysts identified a new wave of attacks targeting the same MS-SQL servers. The attackers deployed ICE Cloud, a scanner malware written in the Go programming language, indicating a shift from the Rust-based scanner used in 2025. Internal binary strings in ICE Cloud are written in Turkish, linking the campaign to the Mimic ransomware attacks of 2024.
This campaign has been active since January 2024 and continues into 2026, with the attackers consistently enhancing their tools.
The attack begins with Larva-26002 identifying an MS-SQL server with poor password management. After gaining access through brute force or dictionary attacks, system commands such as hostname , whoami , and netstat -an are executed to profile the host. Malware is then created using the BCP utility, exporting a malicious binary from the database table uGnzBdZbsi to a local path as api.exe , guided by a formatting file named FODsOZKgAU.txt .
If BCP fails, the malware is retrieved using Curl or Bitsadmin via PowerShell. The api.exe file, known as ICE Cloud Launcher, connects to a C&C server for authentication before downloading the core scanner, ICE Cloud Client. Once downloaded, the malware registers with the C&C server, which provides a list of MS-SQL addresses and credentials to target. The scanner attempts to log in using these credentials and reports any successful access back to the server.
Database administrators are advised to implement robust, hard-to-guess passwords for all MS-SQL accounts, updating them regularly to prevent unauthorized access. MS-SQL servers exposed to the internet should be secured behind a firewall allowing only authorized connections. Endpoint security software should be kept up to date to detect and prevent malware execution on hosts. Administrators should monitor for unusual BCP activity, unexpected files like api.exe in C:\ProgramData\ , or unrecognized outbound connections, treating them as potential compromises requiring immediate investigation.
Based on reporting by Cyber Security News.