Ransomware .PIZ via MSSQL: comparing the attack chain with CyRadar's source

Archived analysis • Incident-chain descriptions not independently verified. This content is retained for comparison, not as confirmation of an incident.

The key point of this case is not the extension .piz, but the attack chain before encryption. The indicators suggest scanning, password guessing, SQL Server execution capabilities, remote-control setup and a deliberate Safe Mode boot to weaken protections before mass encryption.

1. Overview of the attack chain

The archived infographic, attributed to CyRadar with provenance not yet checked, divides the incident into five stages. It fits a hands-on-keyboard model: interaction with the server, control of privileges, installation of access tools and environment preparation before impact, rather than immediate encryptor deployment.

2. Why MSSQL matters

MSSQL underpins many ERP, HIS, accounting and business systems. The concern is deployment: Internet-exposed management ports, weak passwords, excessive privileges, OS-command execution features or highly privileged extensions.

2.1. SQL account brute force sa

MITRE ATT&CK classifies password guessing as T1110.001. MSSQL/1433 and RDP/3389 are common password-guessing targets. Tens of thousands of Internet login failures without rate limits, IP reputation, firewall allowlists or SOC alerts give attackers time to test credentials.

2.2. CLR Assembly and execution beyond the database

SQL Server's legitimate CLR Integration runs .NET code in the Database Engine. Abused with high privileges, CLR assemblies can enable execution and persistence. MITRE describes SQL stored-procedure/CLR assembly abuse under T1505.001 – SQL Stored Procedures.

Microsoft also warns that assemblies with EXTERNAL_ACCESS or UNSAFE permissions can access resources outside the database. Production requires control of signing, trusted assemblies, assembly creation privileges and CLR configuration.

2.3. xp_cmdshell must not be a permanent switch

Microsoft states that xp_cmdshell is disabled by default on new installations and should generally stay disabled unless needed. Where legacy software requires it, limit enablement duration, invocation rights and monitor configuration changes.

3. AnyDesk: legitimate software that can become a C2 channel

AnyDesk is legitimate remote-desktop software. After intrusion, a common remote tool installed as a Service can provide durable, convenient access. MITRE ATT&CK describes this behavior under T1219.002 – Remote Desktop Software.

The defensive objective is not to ban AnyDesk at any cost, but to distinguish enterprise-approved remote tools and remote tools appearing outside procedure. A database server unexpectedly installing an AnyDesk service at midnight, connecting to unfamiliar infrastructure and then rebooting into Safe Mode is a high-priority sequence.

4. Safe Mode and disabling defenses

Ransomware operators have used Safe Mode to reduce loaded security services/drivers. The old analysis (not independently verified) reports Kaspersky disabled and Process Hacker/related drivers interfering with protective processes. In ATT&CK, this is consistent with T1562.001 – Impair Defenses: Disable or Modify Tools.

5. What the extension .PIZ can — and cannot — tell us

Files renamed to .piz establish one observed characteristic, but do not provide sufficient evidence to assign a ransomware family. Extensions are easily changed: operators may configure different values per victim, rebuild encryptors or reuse another group's suffix.

For more accurate identification, IR teams should collect at least:

• Original ransom notes, filenames and content.
• 1–3 pre/post-encryption files where comparison pairs exist.
• Encrypted-file headers/trailers, markers and entropy.
• Hashes of encryptors, loaders, DLLs/drivers and remote tools.
• Process tree, command line, service, scheduled task, autorun.
• IPs/domains/URLs related to RDP, AnyDesk or other C2 channels.
• $MFT, $UsnJrnl, $LogFile, Windows Event Logs and SQL logs.

6. MITRE ATT&CK mapping from public data

The table below is only behavior-level mapping of published observations, not attribution to an actor or family.

7. Signals for SIEM/EDR

Build rules around behavior preceding ransomware rather than only hunting a ransomware file. High-value signals in this case include:

8. Defensive lessons — what should change?

8.1. Do not expose RDP/MSSQL directly to the Internet

This is the first priority. CISA recommends restricting or removing direct RDP. Where remote access is needed, use VPN/ZTNA, access-layer MFA, IP restrictions, session logging and separate administrator/user accounts.

8.2. Apply least privilege to SQL accounts

Business applications should not use sa or logins with sysadmin unless genuinely required. Use separate application logins with access only to required databases; prohibit assembly/SQL Agent Job creation and server changes where business functions do not require them.

8.3. Place MFA at the right layer

MFA is strategically sound but must be implemented at the appropriate layer. Traditional SQL Authentication cannot simply enable MFA for account saas Microsoft 365 can. Prioritize MFA on VPN/ZTNA, AD/Entra accounts, RDP gateways, PAM and management portals. Restrict SQL authentication and use Windows/AD authentication where appropriate.

8.4. Separate backups from production's blast radius

CISA emphasizes offline/immutable backups and regular restore tests. NAS/share/object-storage backups continually mounted with production credentials that can delete/write may be encrypted or destroyed alongside primary data.

8.5. Monitor critical configuration changes

On database servers, changes to CLR, xp_cmdshell, OLE Automation, SQL Agent, sysadmin privileges, startup procedures and service accounts require an audit trail. Send alerts to an independent system so deleting host logs cannot erase every artifact.

9. What to prioritize if a server is being encrypted

1. Isolate the network immediately but avoid rushed deletion/reset operations that destroy artifacts.
2. Disconnect external access: RDP, suspected VPN accounts, uncontrolled AnyDesk/RMM and unusual firewall rules.
3. Preserve evidence: Event Logs, SQL Logs/Audit, Sysmon/EDR telemetry, $MFT, $UsnJrnl, useful RAM contents and encryptor/driver/ransom-note samples.
4. Do not immediately restore over the infected system. Build a clean recovery environment and identify persistence first.
5. Check backups in order of trust: immutable/offline → independent snapshots → copies with separate credentials → supplementary data sources.
6. Identify ransomware using multiple artifacts, not just an extension.
7. Prioritize critical business data such as SQL MDF/LDF, HIS/PACS and ERP before lower-priority files.

10. Conclusion

The chain described in the old No.Ransomware.VN version (not independently verified) illustrates a principle: ransomware is often the final stage, not the first stage of an incident. Focusing only on an encryptor and the extension .pizcan miss valuable artifacts: prolonged brute force, abused SQL privileges, CLR assemblies, legitimate remote tools used as C2, Safe Mode and disabled defenses.

For organizations with SQL Server, ERP/HIS/PACS or critical internal systems, reducing Internet exposure, separating privileges, hardening SQL, controlling RMM, monitoring changes and maintaining immutable/offline backups are more valuable than expecting one antivirus product to stop the entire chain.

Sources & references

1. CyRadar – the post “RANSOMWARE ATTACK: LESSONS FROM A REAL INCIDENT” and the infographic supplied with the original content. Main page: https://cyradar.com/
2. CyRadar — “MSSQL server attack campaign: three backdoor layers and fileless malware persisting for over six weeks”: cyradar.com/2026/09/08/...
3. Microsoft Learn – Create an Assembly / SQL CLR Security: learn.microsoft.com/.../creating-an-assembly
4. Microsoft Learn – xp_cmdshell server configuration: learn.microsoft.com/.../xp-cmdshell-server-configuration-option
5. MITRE ATT&CK – T1110.001 Password Guessing: attack.mitre.org/techniques/T1110/001/
6. MITRE ATT&CK – T1021.001 Remote Desktop Protocol: attack.mitre.org/techniques/T1021/001/
7. MITRE ATT&CK – T1505.001 SQL Stored Procedures: attack.mitre.org/techniques/T1505/001/
8. MITRE ATT&CK – T1219.002 Remote Desktop Software: attack.mitre.org/techniques/T1219/002/
9. MITRE ATT&CK – T1486 Data Encrypted for Impact: attack.mitre.org/techniques/T1486/
10. CISA – #StopRansomware Guide: cisa.gov/stopransomware/ransomware-guide