Statistical Report on Malware Targeting Windows Database Servers in the Second Quarter of 2026

ASEC's Q2 2026 analysis describes active attacks against MS‑SQL, MySQL and SoftEther VPN‑exposed servers that deploy CLR SqlShell and other malware (Trojans, backdoors, downloaders, coinminers). Attackers used certutil/curl/PowerShell to retrieve payloads, set the UseLogonCredential/WDigest setting for plaintext credential access, and employed BadPotato/EfsPotato for privilege escalation; the report includes an MD5 and multiple download URLs and recommends patching, stronger account management, and access controls.