A dangerous botnet called GoBruteforcer is ramping up brute-force attacks on internet-exposed Linux servers, focusing on services like FTP, MySQL, PostgreSQL, and phpMyAdmin. Check Point Research (CPR) warns that over 50,000 servers remain vulnerable due to weak credentials and poor configurations, turning them into new attack nodes after compromise. This surge exploits common defaults from tutorials and legacy stacks like XAMPP, amplifying risks for organizations worldwide.
The botnet, first spotted in 2023, evolved into a more sophisticated Go-written variant by mid-2025, featuring advanced obfuscation, persistence mechanisms, and process-hiding tricks like renaming to "init". Infected servers scan random IPs and test credential lists with usernames such as "admin," "appuser," or crypto-themed ones like "cryptouser," rotating campaigns weekly for efficiency. Low success rates still pay off given millions of exposed databases and FTP ports.
Financial motives drive some operations, with attackers deploying Go tools to scan TRON balances and sweep tokens from Binance Smart Chain on compromised hosts. CPR found 23,000 TRON addresses on one server, and on-chain data confirmed small thefts, highlighting resale potential for stolen access or data. Targeted attacks hit WordPress-linked phpMyAdmin panels and blockchain databases.
CPR links this threat to AI-generated deployment guides that propagate insecure defaults, predicting worse risks as server setups become easier. Legacy web environments and credential reuse from leaked databases fuel the botnet's spread, with C2 servers distributing modular components like IRC bots and bruteforcers.
Mitigation demands strong passwords, MFA, service lockdowns, and exposure monitoring beyond takedowns. Disabling unnecessary ports and auditing configs counters brute-force economics, while tools block known IOCs like C2 domains (e.g., fi.warmachine.su) and SHA-256 hashes for IRC bots. Proactive hygiene remains key against persistent threats like GoBruteforce.
