APT41__2019__Winnti_Group_s_skip_2.0_A_Microsoft_SQL_Server_backdoor.pdf

ESET researchers describe 'skip-2.0', a sophisticated Winnti Group MSSQL backdoor that is delivered via a VMProtected launcher and a custom packer, injects into sqlserv.exe, hooks authentication and logging functions in sqllang.dll to allow access using a hardcoded 'magic' password while suppressing audit logs, and provides indicators of compromise and ATT&CK technique mappings.