Larva-26009
Larva-26009 targets MS-SQL servers and has been observed installing the XMRig CoinMiner.
source: misp-galaxy1 refs →
Larva-26009
Financially motivated Larva-26009 targets MS-SQL servers to deploy XMRig CoinMiner for cryptocurrency mining.
Analyst brief
Larva-26009 is a financially motivated threat actor of unknown origin. It primarily targets MS-SQL servers. The attacker has been observed installing XMRig CoinMiner to exploit victim resources for cryptocurrency mining. Defenders should monitor for brute-force attacks against MS-SQL servers, suspicious SQL queries, and C2 communications associated with XMRig.
unknown
FAQ2
What type of servers does the Larva-26009 threat actor typically target?
Larva-26009 primarily targets MS-SQL servers.
What malware does Larva-26009 install on victim systems?
Larva-26009 installs XMRig CoinMiner to exploit victim resources for cryptocurrency mining.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.