MSP Moment: Squashing an MSSQL Attack

A client’s SQL Server was compromised after attackers brute-forced the SA account; they disabled firewall services, downloaded obfuscated backdoors over FTP, created persistence, deleted MSSQL/Windows event logs, and deployed post-exploitation tools (including a cryptocurrency miner and registry changes to block antivirus). Huntress and NTConnections detected the intrusion, reconstructed the timeline, recommended remediation, and restored the environment to contain the breach.