Statistics Report on Malware Targeting Windows Database Servers in Q4 2025

AhnLab ASEC reports increased attacks in Q4 2025 against Internet-exposed MS-SQL/MySQL servers by the Trigona ransomware actor and associated criminal operators. The report details their workflow — credential brute-forcing, use of CLR Shell and BCP to write and deploy binaries from databases, downloaders (curl, bitsadmin, PowerShell), Rust-based scanners, installers for remote control (AnyDesk, Teramind, RDP users), and additional payloads (coinminers, proxyware, backdoors like Gh0stRAT/CobaltStrike/Meterpreter). It includes technical TTPs, sample commands, malware hashes, URLs, and IP addresses to support detection and response.