Construction firms breached in brute force attacks on accounting software

Huntress observed aggressive brute-force attacks targeting on-premise Foundation accounting MSSQL servers (often exposed on TCP 4243) that use default/weak admin credentials ('sa' and 'dba'); attackers are enabling xp_cmdshell to execute OS commands and have achieved successful breaches across plumbing, HVAC, concrete and other construction firms. Recommendation: rotate credentials, remove or restrict public MSSQL access, and harden affected servers.