MSSQL Post-Exploitation Toolkit Could Enable Credential Theft and Lateral Movement Attacks

Researchers discovered an unauthenticated MSSQL staging server (151.243.232.123) hosting 17 post‑exploitation tools, credential-harvesting scripts (e.g., chrome_dump.ps1, cred_dump.ps1), Mimikatz outputs, and directories of stolen material tied to activity against a Viva Aerobus environment; attackers used xp_cmdshell and SQL-based Base64 file transfer to execute commands and exfiltrate data, and evidence shows credential harvesting, credential-reuse testing, and lateral-movement preparation, with IOCs including the exposed IP and an exfil tool SHA256.