Security News > 2020 > April > Cyberscum target Microsoft SQL Server boxen – and some careless sysadmins were reinfected after cleaning it out

"The Vollgar attack chain also demonstrates the competitive nature of the attacker, who diligently and thoroughly kills other threat actors' processes," the firm said in a statement.
Lead researcher Ophir Harpaz said in a research report: "Overall, Vollgar attacks originated in more than 120 IP addresses, the vast majority of which are in China. These are most likely compromised machines, repurposed to scan and infect new victims."
Worse, around 10 per cent of the machines observed by Harpaz and her team were reinfected by Vollgar's operators - suggesting sysadmins may not be taking routine infosec hygiene as seriously as they perhaps ought to be.
Vollgar's two main attack methods are planting cryptominers to create virtual currency through stealing compute resources, and planting remote-access tools.
Guardicore Labs is also providing a free Powershell detection script aiding detection of Vollgar's tracks on infected machines, the outfit said.
News URL
Related news
- Microsoft 365 apps crash on Windows Server after Office update (source)
- Microsoft fixes Office 365 apps crashing on Windows Server systems (source)
- Microsoft fixes Windows Server 2022 bug breaking device boot (source)
- Microsoft issues out-of-band fix for Windows Server 2022 NUMA glitch (source)
- Microsoft: Outdated Exchange servers fail to auto-mitigate security bugs (source)
- Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers (source)
- Microsoft fixes bug causing Windows Server 2025 boot errors (source)