Threat Actors Target MS-SQL Servers to Deploy ICE Cloud Scanner Malware

Larva-26002 is actively targeting poorly secured MS-SQL servers via brute-force and dictionary attacks, deploying a Go-based scanner called ICE Cloud Client that registers with a C2, receives target lists and credentials, and reports successful compromises; attackers commonly abuse the BCP utility to export payloads (e.g., api.exe) from database tables and have reused identifiers and tooling across campaigns that previously delivered Trigona and Mimic ransomware.