By Tushar Subhra Dutta
Publication Date: 2026-10-02 14:04:00
Hackers turned a Microsoft SQL Server into a channel for running commands and moving collected files in an intrusion linked to a Viva Aerobus environment. Their own publicly accessible server then exposed attack tools and stolen material to unrelated internet users.
The activity, observed between September 25 and 29, 2026, involved credential harvesting, source code collection, and preparation to access additional systems.
The investigation did not establish how the attackers first entered the environment or identify a named malware family. The available records describe a toolkit rather than a single implant. ThreatMon researchers identified the exposed infrastructure during routine threat hunting.
ThreatMon said in a report shared with Cyber Security News (CSN) that the server contained 17 named tools, offering an unusually detailed view of the operation after the initial compromise.
The findings reveal a second exposure layered onto the original intrusion, but not…
