Summary
Security researchers have documented a technique in which attackers who have compromised a Microsoft SQL Server instance weaponize it as a command-and-control channel and data exfiltration pathway, using SQL Server’s own legitimate features to communicate with attacker infrastructure while evading network detection tools that whitelist database traffic. The technique exploits SQL Server’s linked server functionality and replication features to tunnel C2 communications and exfiltrate data through outbound SQL connections that security tools typically treat as authorized internal database traffic.
Timeline
| Date | Event |
|---|---|
| Oct 4, 2026 | Security researchers publish documentation of SQL Server C2 and exfiltration technique; CybersecurityNews reports |
What Happened
Microsoft SQL Server’s linked server feature allows one SQL Server instance to query another SQL Server instance across a network connection. Attackers with control of a SQL Server instance can configure a linked server connection pointing to attacker-controlled infrastructure, then use SQL queries executed on the compromised server to send data to and receive commands from the attacker’s SQL Server. From a network perspective, this traffic appears as legitimate SQL Server database replication or linked server query traffic on standard SQL Server ports, which many organizations’ network security tools are configured to allow without deep inspection.
The data exfiltration variant uses SQL Server replication — a feature designed for synchronizing databases across servers — to continuously stream selected data from the compromised server to attacker-controlled infrastructure. This is a living-off-the-land technique: it uses only built-in SQL Server features, leaves no external tooling on the compromised system, and generates traffic patterns consistent with legitimate database operations. Organizations running internet-connected SQL Server instances or SQL Server instances with outbound network access should audit linked server configurations and replication subscriptions for unauthorized entries, and consider restricting outbound SQL Server traffic to known-good destinations at the network layer.
Domain Intelligence
microsoft.com — 73.27
microsoft.com scores at 73.27 in the high-trust range with clean flags. Microsoft is the developer of SQL Server, whose legitimate features are being abused in this technique.