Full Report
See how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.
Analysis Summary
# Incident Report: SQL Injection and BadIIS Persistence
## Executive Summary
A threat actor compromised a technology sector organization by exploiting a SQL injection vulnerability in a web-facing IIS server. Following initial access via the MSSQL process, the attacker deployed sophisticated persistence mechanisms, including a "BadIIS" rogue module, disabled security software, and installed a cryptominer. The incident underscores the risk of post-compromise environment modification used to ensure long-term residency.
## Incident Details
- **Discovery Date:** June 26, 2026 (Reported)
- **Incident Date:** June 2026
- **Affected Organization:** Not disclosed
- **Sector:** Technology
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** June 2026
- **Vector:** SQL Injection (SQLi)
- **Details:** The attacker exploited a lack of input validation on an IIS web page. This allowed them to execute commands via the `sqlservr.exe` process.
### Lateral Movement
- **Details:** While the primary focus was environment modification, the attacker performed internal reconnaissance using `tasklist /svc` to identify running services and potential targets for spoofing or further exploitation.
### Data Exfiltration/Impact
- **Details:** System resources were diverted to unauthorized cryptocurrency mining. The attacker also exfiltrated system metadata (process lists) to an external listener.
### Detection & Response
- **Detection:** The Huntress SOC detected malicious activity originating from the Microsoft SQL Server instance.
- **Response:** Analysts identified the exploited web page, uncovered the malicious IIS modules, and traced the PowerShell-based deployment of the miner.
## Attack Methodology
- **Initial Access:** SQL Injection (SQLi) on a web-facing IIS server.
- **Persistence:** Installation of **BadIIS** (a rogue IIS module) and creation of new user accounts.
- **Privilege Escalation:** Execution of commands through the service account running MSSQL.
- **Defense Evasion:** Disabling Windows Defender; using base64-encoded PowerShell scripts; and employing "BadIIS" to intercept/hide traffic.
- **Discovery:** Execution of `tasklist /svc` to map environment processes.
- **Lateral Movement:** Internal reconnaissance via legitimate Windows CLI tools.
- **Collection:** Gathering system process information.
- **Exfiltration:** Exfiltrating process data via `Invoke-WebRequest` POST requests.
- **Impact:** Deployment of a cryptominer to utilize system hardware.
## Impact Assessment
- **Financial:** Increased operational costs due to unauthorized electricity and compute consumption (cryptomining).
- **Data Breach:** Exfiltration of system configuration and process details.
- **Operational:** Disabling of critical security controls (Windows Defender) and unauthorized modification of the IIS server configuration.
- **Reputational:** Risk of secondary attacks due to established attacker persistence.
## Indicators of Compromise
- **Network indicators:** `334thribetlhkyo977gqrcht1k7bvdj2[.]oastify[.]com` (Exfiltration endpoint)
- **File indicators:** Rogue IIS DLLs (BadIIS), Base64 encoded PowerShell scripts.
- **Behavioral indicators:** `sqlservr.exe` spawning PowerShell; unexpected `tasklist /svc` executions; Windows Defender being disabled via CLI.
## Response Actions
- **Containment:** Terminated malicious processes and blocked the attacker's C2 domain.
- **Eradication:** Removed the "BadIIS" module from the IIS configuration, deleted unauthorized user accounts, and removed cryptomining binaries.
- **Recovery:** Restored Windows Defender functionality and patched the vulnerable web code responsible for the SQL injection.
## Lessons Learned
- **Root Cause Importance:** Focusing only on the cryptominer would have missed the underlying SQLi vulnerability and the persistent IIS module.
- **Environment Modification:** Attackers are increasingly "reshaping" the host environment (disabling AV, adding accounts) to make eviction harder.
- **Blind Spots:** Standard monitoring might miss rogue IIS modules (BadIIS) as they load into legitimate web server processes.
## Recommendations
- **Code Audit:** Implement strict input validation and prepared statements for all web applications to prevent SQL injection.
- **Least Privilege:** Run MSSQL and IIS services with the minimum necessary permissions to prevent OS-level command execution.
- **Integrity Monitoring:** Monitor IIS configurations and module folders for unauthorized additions.
- **Endpoint Protection:** Use EDR solutions that alert on the disabling of security providers like Windows Defender.