Researchers from ThreatMon uncovered an exposed attacker infrastructure during a routine internet scan, revealing 17 attack tools along with material stolen from the environment of airline Viva Aerobus.
Attackers obtained operating system access by abusing xp_cmdshell, a feature in SQL Server that executes system commands when enabled. Through this channel, the intruders sent Windows commands and encoded PowerShell payloads directly via database sessions.
The most stealthy aspect of the operation was data exfiltration. Instead of establishing separate communication channels, the tools read file contents, divided them into smaller segments, converted the data to Base64, and returned everything as the result of standard SQL queries. From a network perspective, the traffic appeared as normal database responses, significantly reducing the likelihood of alerts triggered by unusual connections.
The recovered material included browser credentials, Windows credentials, SQL credentials, source code, configuration files, database connection data, references to OAuth integrations, email systems, SFTP servers, and payment systems, as well as connection history stored in SQL Server Management Studio.
The activity was observed between September 25 and 29. Researchers were unable to determine the initial entry point, could not link the tools to any known malware family, and found no evidence of access to additional systems or theft of passenger or payment card data.
Recommendations include investigating unexpected use of xp_cmdshell, encoded PowerShell, and file operations performed by SQL Server service accounts. Organizations should also treat saved connections and passwords in administration tools as sensitive information.
