Larva-26002 Threat Actor Escalates Attacks on MS-SQL Servers

ASEC warns that Larva-26002 continues a multi-year campaign against poorly configured, internet-exposed MS-SQL servers, now using a new Go-based scanner named ICE Cloud that performs brute-force logins and retrieves payloads (via api.exe and ICE Cloud Launcher). The report describes delivery via BCP and common Windows tools, use of remote-control and RMM tools (AnyDesk, Teramind), reconnaissance and SQL-targeted commands, storage of malware in database tables, and links to prior ransomware distribution (Trigona, Mimic).