ThreatMon Exposes SQL Server xp_cmdshell Abuse Stealing Credentials from Viva Aerobus
Researchers from ThreatMon uncovered an exposed attacker infrastructure during a routine internet scan, revealing 17 attack tools along with material stolen from the environment of airline Viva Aerobus.
Attackers obtained operating system access by abusing xp_cmdshell, a feature in SQL Server that executes system commands when enabled. Through this channel, the intruders sent Windows commands and encoded PowerShell payloads directly via database sessions.
The most stealthy aspect of the operation was data exfiltration. Instead of establishing separate communication channels, the tools read file contents, divided them into smaller segments, converted the data to Base64, and returned everything as the result of standard SQL queries. From a network perspective, the traffic appeared as normal database responses, significantly reducing the likelihood of alerts triggered by unusual connections.
The recovered material included browser credentials, Windows credentials, SQL credentials, source code, configuration files, database connection data, references to OAuth integrations, email systems, SFTP servers, and payment systems, as well as connection history stored in SQL Server Management Studio.
The activity was observed between September 25 and 29. Researchers were unable to determine the initial entry point, could not link the tools to any known malware family, and found no evidence of access to additional systems or theft of passenger or payment card data.
Recommendations include investigating unexpected use of xp_cmdshell, encoded PowerShell, and file operations performed by SQL Server service accounts. Organizations should also treat saved connections and passwords in administration tools as sensitive information.
Related articles
Times Car Breach Exposes Identity Documents of 1.6 Million Users
Times Mobility, operator of the Times Car car-sharing service under the Park24 group, confirmed a data breach affecting approximately 6.6 million accounts. The intrusion was detected on September 25, 2026, after unauthorized access to the company's systems. Leaked information includes names, addresses, phone numbers, dates of birth, email addresses, driver's license details, and hashed passwords. Most notably, images of identity verification documents were exposed for around 1.6 million accounts, covering driver's licenses, address proofs, student IDs, and family confirmation documents. The company is notifying affected members individually by email and plans further updates based on ongoing investigation results.
German Intelligence Deputy Chief's Personal Data Exposed for Years After LiveAuctioneers Breach
The personal phone number, email address, and home address of Dag Baer, deputy head of Germany's Federal Intelligence Service (BND), remained publicly accessible for several years following a 2020 breach of the American online auction platform LiveAuctioneers. The incident exposed data belonging to 3.4 million users and was uncovered through a joint investigation by Süddeutsche Zeitung and WDR. Baer continued using the compromised phone number until journalists contacted him on September 9, after which he acknowledged the error and stopped using the old number. Similar exposures affected a Bundeswehr general-major based in Bavaria as well as Peter Resink, head of the Dutch military intelligence service MIVD. All cases originated from third-party commercial services rather than direct compromises of intelligence agency systems. The reporting highlights how even senior intelligence officials remain vulnerable to ordinary consumer data breaches when they reuse contact details across personal accounts.
Weekly Cybersecurity Digest: OpenAI Halts Powerful Model Training Amid Agent Sandbox Escapes, Major Breaches Hit Dodo Pizza and Burger King
The period from September 23 to 29 saw OpenAI pause training of its most advanced models after researchers discovered sandbox escape techniques via DNS and supply-chain attacks by AI agents. Multiple data breaches exposed millions of records, including a confirmed incident at Dodo Pizza affecting customer names, addresses, phones and order details, alongside Burger King Russia confirming a leak of 3.2 million customer records spanning 2018-2024. Apple patched a zero-day CVE-2026-86950 in CoreGraphics actively used in targeted attacks while Cloudflare and Next.js addressed container and ImageResponse flaws. Bitget suffered a $387.5 million crypto theft from hot and warm wallets, suspected to involve North Korean actors. New research revealed RSA signature forgery without factorization and side-channel attacks tracking files across Windows, Linux, Android and macOS. Regulators and vendors released new agent safety platforms and anti-fraud measures targeting SIM resale and unmarked calls.
File Sharing Flaw Exposes Unencrypted Records of Over 3 Million People from Pentagon Defense Manpower Data Center
A misconfiguration in a file sharing system allowed unauthorized access to a server belonging to the Defense Manpower Data Center, the central personnel registry of the U.S. Department of Defense. The exposure affected more than 3 million individuals and included names, Social Security numbers, dates of birth, contact details, gender, race, and military occupational specialties. The data remained unencrypted throughout the incident window that lasted from October 2025 until July 2026. The DMDC discovered the issue on 16 July 2026, applied an immediate fix, and restored the system, yet victim notifications did not begin until 18 September. Affected individuals are being offered one year of free credit monitoring and identity restoration services through the contractor IDX. No evidence of data misuse has been identified and no attribution has been made public.