xp_cmdshell

ThreatMon Exposes SQL Server xp_cmdshell Abuse Stealing Credentials from Viva Aerobus

Researchers at ThreatMon discovered an exposed attacker infrastructure containing 17 attack tools and data stolen from airline Viva Aerobus. Attackers gained operating system access through the xp_cmdshell feature in SQL Server, which allows execution of system commands when enabled. They issued Windows and encoded PowerShell commands directly through database sessions. Data exfiltration occurred by reading files, splitting content into smaller chunks, converting to Base64, and returning results via normal SQL query responses to avoid network detection. Recovered materials included browser, Windows, and SQL credentials, source code, configuration files, database connection strings, OAuth, email, SFTP, and payment system references, plus connection history from SQL Server Management Studio. Activity took place between September 25 and 29, with no identified initial access vector or link to known malware families.