larva-26002

Executive Summary

Larva-26002 is a threat actor targeting Windows-based MS-SQL and MySQL database servers through malicious attacks involving credential brute force, dictionary attacks, and exploitation of unpatched systems. The actor deploys a Go-based scanner named ICE Cloud to access these systems using predefined credentials and Turkish language strings in their toolset.

Goals & Targeting

Larva-26002 appears to target sectors that maintain sensitive databases, such as financial institutions, healthcare providers, and critical infrastructure organizations. Their focus on MS-SQL and MySQL suggests an interest in data extraction and potential disruption of operational systems. The actor's geographic targeting is currently undefined due to limited intelligence but may be focused on regions with weaker cybersecurity practices or underpatched systems. The use of predefined credentials indicates a desire to exploit poor account management practices rather than advanced technical vulnerabilities. Their goal likely involves data theft, espionage, or sabotage.

Larva-26002 primarily focuses on compromising database servers, leveraging a combination of brute force, dictionary attacks, and exploitation techniques targeting misconfigured and unpatched systems. The actor employs tools such as BCP, curl, bitsadmin, and PowerShell to deploy their Go-based ICE Cloud scanner. This tool identifies MS-SQL authentication vulnerabilities using predefined credentials and attempts unauthorized access. Larva-26002's activities are characterized by their systematic approach to scanning and exploiting database infrastructure, likely seeking sensitive data or internal communications for malicious purposes. The use of Turkish language strings suggests a potential linguistic link to the actor, though no definitive attribution can be made from this observation. Despite a temporary decrease in activity during February 2026, the threat actor's attacks resumed with intensity in March, indicating a persistent and potentially coordinated campaign targeting critical database systems.

Key Capabilities

• Credential brute force
• Dictionary attacks
• Exploitation of unpatched systems
• Use of toolset (BCP, curl, bitsadmin, PowerShell)
• Deployment of Go-based ICE Cloud scanner
• C2 communication via Turkish language strings

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Larva-26002 has demonstrated a consistent campaign pattern of attacking database servers, with peaks in activity during March 2026 despite a temporary lull. Their targeting appears to focus on systems with misconfigured accounts and unpatched vulnerabilities. Campaign activities are likely coordinated, using ICE Cloud as the primary toolset for scanning and exploitation. Recent operations suggest the actor is adaptative, pausing temporarily but resuming attacks with refined techniques.

IOC Patterns

• Spear-phishing emails containing malicious scripts targeting database administrators
• Use of Turkish language strings in C2 communication channels
• Script-based network scanning for MS-SQL and MySQL services
• Brute force attempts against MS-SQL authentication
• Use of predefined credential lists for attacks
• C2 activity over HTTPS or encrypted channels

Recommended Actions

• Harden database server configurations and patch promptly
• Monitor network traffic for unusual scanning patterns
• Implement multi-factor authentication for critical accounts
• Deploy endpoint detection tools to identify malicious scripts
• Review and update account management practices to eliminate weak passwords
• Set up network-based monitoring for known C2 IP ranges

Suggested Tags