Hackers target Microsoft SQL servers in Mimic ransomware attacks

Security researchers observed a financially motivated Turkish threat group (RE#TURGENCE) targeting internet-facing MSSQL servers via brute-force and insecure configurations to execute xp_cmdshell, deploy obfuscated Cobalt Strike implants, install AnyDesk for remote access, harvest credentials with Mimikatz, escalate to domain controllers, and ultimately deploy Mimic (N3ww4v3) ransomware (or sell access); victims were reported across the EU, US, and Latin America.