Huntress Analysis: Post-Exploitation Tactics After SQL Injection

A security analysis by Huntress of a real-world incident from June reveals the precise steps attackers take to maintain control over a compromised system. The investigation highlights a shift from immediate data theft toward long-term environment reshaping and persistence.

Initial access was gained through a SQL injection vulnerability on a webpage hosted on a Microsoft SQL Server. Once the breach was successful, the attacker moved quickly to secure a permanent foothold on the Windows machine. This was achieved by enabling Remote Desktop (RDP) and creating a new local administrator account, ensuring they could return to the system regardless of whether the original entry point was closed. To further shield their activities, the attacker disabled Windows Defender, although other Endpoint Detection and Response (EDR) tools remained untouched.

The Payload and Persistence

With administrative control established, the attacker deployed a variety of malicious tools designed for financial gain. They installed BadIIS modules, which were used to hijack legitimate website traffic to facilitate search-engine fraud. Additionally, the attacker deployed XMRig, a well-known cryptocurrency miner. To avoid detection by system administrators, the miner was configured as a hidden Windows service, allowing it to run silently in the background while consuming system resources.

The Strategy of Dwelling

This incident illustrates a common tactical pattern where adversaries prioritize "dwelling" over immediate disruption. By modifying system configurations and creating backdoors, attackers ensure that their presence is durable. The goal is to transform the compromised host into a reliable platform for secondary attacks or ongoing monetization, such as the fraud and mining operations seen in this case. This approach allows the attacker to maintain access even if specific pieces of malware are detected and removed by security software.

The Risk of Surface-Level Cleanup

This case underscores the critical danger of "surface-level cleanup" during incident response. If defenders focus solely on removing the visible symptoms—such as deleting the XMRig miner or the BadIIS modules—without identifying and patching the root cause, the system remains fundamentally insecure. Because the attacker utilized a SQL injection vulnerability for entry and created a separate administrator account for persistence, the threat actor can simply re-enter the environment using the same vulnerability or the backdoor account.

Security professionals are advised to look beyond the malware to identify configuration changes and unauthorized accounts. Until the original SQL injection vulnerability is patched and all persistence mechanisms are purged, the attacker retains the ability to escalate the attack in future attempts.