Threat Actors Installing DB Client Tools on Targeted Systems to Exfiltrate Sensitive Data

Cybersecurity researchers have uncovered a concerning trend where threat actors are increasingly leveraging legitimate database client tools to steal sensitive information from compromised systems.

This sophisticated approach represents a significant evolution in data exfiltration techniques, as attackers exploit trusted applications like DBeaver, Navicat, and sqlcmd to blend seamlessly with normal administrative activities.

The tactic poses particular challenges for security teams because these tools are commonly used by legitimate database administrators, making malicious activities extremely difficult to distinguish from routine operations.

The attack methodology demonstrates a high level of sophistication, as threat actors must first obtain comprehensive database credentials including server addresses, ports, and authentication information before deploying these client tools.

This suggests that by the time attackers install database clients, they have already progressed through initial compromise, privilege escalation, and reconnaissance phases of their attack campaigns.

The implications are severe, as organizations may remain unaware of ongoing data theft while attackers systematically extract sensitive information using tools that appear completely legitimate to security monitoring systems.

ASEC analysts have identified multiple real-world incidents where threat actors successfully deployed these database client tools following initial system compromise through remote desktop protocol access.

The researchers documented cases where attackers installed DBeaver through web browsers and subsequently extracted data using default file naming conventions, while others utilized Navicat’s 14-day trial period to avoid licensing costs during their operations.

The analysis reveals that these tools leave distinctive forensic traces, though detection requires specialized knowledge of each application’s logging mechanisms and file structures.

The impact extends beyond simple data theft, as these techniques enable attackers to perform comprehensive database reconnaissance, execute complex queries, and export entire tables in various formats including CSV, Excel, and JSON.

The versatility of modern database client tools provides threat actors with unprecedented capabilities to tailor their exfiltration methods based on target database structures and organizational environments.

Furthermore, the legitimate nature of these applications makes them virtually invisible to traditional antivirus solutions, requiring organizations to implement behavior-based detection mechanisms.

DBeaver Exploitation and Forensic Analysis

Among the database client tools being weaponized by threat actors, DBeaver presents unique challenges due to its open-source nature and comprehensive logging capabilities that can both aid and hinder forensic investigations.

The application generates detailed debug logs that create a double-edged sword for security teams, providing valuable forensic evidence while simultaneously offering attackers insights into their own activities.

When threat actors utilize DBeaver’s built-in export functionality, the system creates specific log entries that forensic analysts can leverage to reconstruct the timeline and scope of data exfiltration activities.

The forensic investigation process centers on examining DBeaver’s debug log file located at C:\Users\\AppData\Roaming\DBeaverData\workspace\.metadata\dbeaver-debug.log, which contains comprehensive records of export activities.

Critical log entries include timestamps and file paths, as demonstrated in actual incident analysis:-

2025-05-15 14:37:08.989 - Export to the new file
'C:\Users\Administrator\Desktop\export\PRODUCTS_202505151437.csv'
2025-05-15 14:37:09.101 - Close output stream
2025-05-15 14:37:09.145 - Export to the new file
'C:\Users\Administrator\Desktop\export\USERS_202505151437.csv'

These log entries reveal the exact moment when sensitive data tables were exported, including the precise file naming convention following the pattern ${table}_${timestamp}.

Even when debug logs are unavailable, connection history remains accessible, enabling investigators to determine whether unauthorized users accessed sensitive databases during specific timeframes.

The complementary .log file provides additional forensic value by recording system errors, database connection failures, and SQL syntax errors that often indicate experimental or failed attack attempts by threat actors who lack intimate knowledge of target database structures.

Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here