New Ransomware Attack 'Mimic' Exploits MS-SQL Servers

The Download

A new ransomware family dubbed "Mimic" has emerged from the same Turkish hacking group behind Phobos and Crysis ransomware campaigns.

What sets Mimic apart is its ruthless strategy — a brute force attack on MS-SQL servers. No fancy zero-days or CVEs required; these attackers exploit insecure configurations.

How the Attack Works

1. Initial Access: Attackers scan for internet-exposed MS-SQL servers
2. Brute Force: Weak or default SA credentials are exploited
3. Network Scanning: The SQL server becomes a launchpad to scan the network
4. Credential Theft: Mimikatz is deployed for lateral movement
5. Ransomware Deployment: Mimic ransomware encrypts connected systems

From initial breach to complete network compromise can take up to a month.

What IT Teams Should Do

• Audit SQL Server exposure: Never expose production databases to the internet
• Enforce strong passwords: Eliminate default or weak SA credentials
• Monitor failed logins: Set alerts for brute-force patterns
• Enable MFA: Use Azure AD authentication for SQL Server
• Maintain offline backups: Ensure recovery options exist

ThreatMate's Role

ThreatMate continuously scans for exposed database services and weak authentication configurations.