OceanLotus SQL Server RCE - Suspicious sqlservr.exe Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects anomalous HTTP POST requests to the '/V1/Update/GetUpdate' endpoint on an MSSQL-hosted application, which is associated with malicious activity linked to the OceanLotus (APT32) threat actor group, specifically the Blazing Furnace campaign.