A group of financially motivated Turkish hackers are targeting Microsoft SQL (MSSQL) servers across the globe. The ongoing campaign, coined RE#TURGENCE, is prominently focused on targets in the United States, the European Union, and Latin America. The threat actors have been encrypting victims’ files with Mimic (N3ww4v3) ransomware, using far more targeted and customized approaches for obtaining initial access. After gaining their initial access, the threat actors will typically spend about a month in a victim’s system before deploying Mimic ransomware. During that period, the threat actor will spend time mapping the victim’s system, disabling cyber defenses, and establishing persistence. The campaign has been analyzed to progress in one (1) of two (2) ways; the threat actor will either sell access to the compromised host they’ve obtained or will deploy the ultimate Mimic ransomware payload. The threat actors gain initial access via exposed MSSQL databases through brute forcing. They’ve also been observed deploying heavily obfuscated Cobalt Strike payloads for injection tactics and downloading the AnyDesk remote desktop application to collect credentials extracted using Mimikatz. The hackers have also been able to hack other devices on the network and compromise the domain controlled using previously stolen credentials and the Advanced Port Scanner utility to scan the local network and Windows domain. The Mimic ransomware is the final payload deployed to search for files and ultimately encrypt them if the threat actor chooses not to sell access to the compromised host. The email used in the ransom note (datenklauseo@gmail[.]com) has been used to link the threat actors to the Phobos ransomware group, and other indicators of compromise include the ‘red.exe’ process along with a ‘—IMPORTANT—NOTICE—.txt’ ransom text file.