Threat Actors Exploiting MS-SQL Servers to Deploy XiebroC2 Framework

Cybersecurity: Recent MS-SQL Server Targeted Attacks

There has been a notable increase in attacks on improperly managed MS-SQL servers, resulting in the deployment of the XiebroC2 command-and-control (C2) framework. XiebroC2 provides functionalities similar to other legitimate tools, offering information gathering, remote control, and defense evasion capabilities, making it appealing to threat actors as a cost-effective intrusion platform.

In a documented case, attackers gained unauthorized access to MS-SQL servers by exploiting exposed credentials. They employed brute-force attacks on weak or default passwords, leading to the deployment of various payloads, primarily cryptocurrency miners.

Upon gaining access, attackers used JuicyPotato, a privilege-escalation tool, to exploit specific Windows privileges, allowing elevation to SYSTEM privileges. This was possible because SQL Server services typically operate under low-privilege accounts by default.

Server logs confirmed the download and execution of the XiebroC2 payload using PowerShell’s Invoke-WebRequest function over HTTP. This incident highlights the risks associated with unprotected database servers lacking strong credential policies and network-level access controls.

The XiebroC2 framework includes an implant component written in Go, ensuring cross-platform compatibility with Windows, Linux, and macOS. Once deployed, the implant connects to the attacker's C2 server using a preconfigured AES key and awaits instructions. Key features include:

Reverse shell access File and process management Network monitoring and packet capture Reverse proxy tunneling Screenshot capture

The implant collects environment details, such as process ID, hardware ID, computer name, and user name, before connecting to the C2 server to register the compromised host. Configuration parameters observed in this incident included:

HostPort: 1.94.185[.]235:8433 Protocol: Session/Reverse_Ws ListenerName: test2 AesKey: QWERt_CSDMAHUATW

These parameters enable a secure, persistent, encrypted WebSocket session over TCP, allowing the attacker to execute commands or deploy additional payloads.

Enforce Strong Authentication Policies: Disable weak or default credentials on MS-SQL servers. Implement complex, unique passwords and account lockout policies to minimize brute-force and dictionary attack success rates.

Limit Public Exposure: Ensure MS-SQL instances are not directly accessible from the internet. Use network segmentation and firewall rules to restrict access to authorized application servers or VPN endpoints.

Patch and Update: Keep all endpoints running MS-SQL services fully patched with the latest security updates, addressing vulnerabilities that could lead to compromise and privilege escalation.

Monitor and Alert: Deploy intrusion-detection systems to flag unusual login attempts, privilege-escalation tool execution, and unexpected outbound network connections.

Endpoint Protection: Use up-to-date antimalware solutions to detect tools like JuicyPotato and C2 framework components. Behavioral analysis can provide early warnings for reconnaissance or lateral-movement activities.

Organizations are advised to adopt a defense-in-depth strategy, as failure to secure authentication mechanisms, maintain up-to-date patches, and restrict network access can result in repeated infections and compromise of critical infrastructure.

Based on reporting by GBHackers.