Threat Actors Target MS-SQL Servers to Deploy ICE Cloud Scanner Malware
In 2026, Microsoft SQL (MS-SQL) servers continue to face significant threats from cyber actors, notably through the deployment of malware such as ICE Cloud Client. The group identified as Larva-26002 has been targeting poorly secured MS-SQL servers,…
In 2026, Microsoft SQL (MS-SQL) servers continue to face significant threats from cyber actors, notably through the deployment of malware such as ICE Cloud Client. The group identified as Larva-26002 has been targeting poorly secured MS-SQL servers, primarily through brute-force or dictionary attacks exploiting weak credentials.
Upon gaining access, attackers perform various reconnaissance activities to understand the compromised environment. This activity has been linked to the Larva-26002 group, known for distributing Trigona and Mimic ransomware in past campaigns.
In 2024, the group utilized MS-SQL servers to deploy ransomware using tools for persistence and remote access. By 2025, they had introduced remote monitoring tools and custom scanners. The current campaign marks a tactical shift with the introduction of a Go-based malware named ICE Cloud.
An observed technique in these campaigns is the misuse of the Bulk Copy Program (BCP) utility, a legitimate MS-SQL tool, for data import and export. Attackers embed malicious payloads in database tables, later extracting them as executable files.
In recent attacks, malware is exported from tables into files using predefined format files. When BCP is not feasible, alternative methods like curl, bitsadmin, or PowerShell are employed to download the payload from remote servers.
Upon gaining access, attackers perform various reconnaissance activities to understand the compromised environment.
The payload, often named api.exe, installs the ICE Cloud Client, a malware acting as a scanner and brute-force tool, labeled as "ICE Cloud Launcher" during execution. It communicates with a command-and-control server to download and execute the main ICE Cloud Client component, masquerading as legitimate applications.
The ICE Cloud Client targets MS-SQL servers and contains Turkish-language strings, a detail previously linked to Mimic ransomware. The presence of emojis in execution logs may indicate the use of generative AI in its development or obfuscation.
The persistence of infrastructure, techniques, and identifiers suggests Larva-26002 is refining its operations rather than starting anew. The shift from ransomware to scanner-based propagation implies a strategy to expand access to vulnerable systems before launching further attacks.
Organizations utilizing MS-SQL servers should implement the following measures to mitigate risks:
Employ strong, complex passwords and enforce regular credential changes. Restrict or disable external access to database servers whenever feasible. Set firewall rules to limit access to trusted IP ranges. Monitor for unusual use of utilities such as BCP, curl, and PowerShell. Regularly update endpoint security solutions to detect and block malware.
Failure to adopt these protective measures can result in repeated compromises, as attackers continue to exploit exposed systems on a large scale.
Based on reporting by GBHackers.