GoBruteforcer Botnet Attacks

A renewed wave of GoBruteforcer activity is actively targeting databases associated with cryptocurrency and blockchain projects. The attackers are co-opting vulnerable servers into a distributed botnet capable of performing large-scale brute-force attacks against common services, including FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux systems.

This campaign is not indiscriminate. Evidence shows a clear focus on infrastructure tied to blockchain ecosystems, reflecting both financial motivation and the abundance of poorly secured development environments in this sector.

Why This Campaign Is Gaining Momentum

Two converging trends are fueling the current surge. First, administrators are increasingly reusing AI-generated deployment guides and server examples, many of which replicate the same weak default usernames and credentials found across online tutorials and documentation. Second, legacy web stacks, particularly XAMPP installations, continue to be deployed with exposed FTP services and administrative interfaces that lack adequate hardening.

Together, these conditions provide attackers with a predictable and fertile attack surface.

From 2023 Origins to a More Dangerous 2025 Variant

GoBruteforcer, also known as GoBrut, was initially documented in March 2023. Early research described a Golang-based malware family designed for Unix-like systems across x86, x64, and ARM architectures. It deployed an IRC bot for command-and-control, installed a web shell for persistent remote access, and retrieved a brute-force module to scan for additional vulnerable hosts.

By September 2025, researchers uncovered that portions of the botnet were operating in tandem with another malware strain, SystemBC, indicating shared infrastructure or coordinated control.

Mid-2025 marked a significant technical leap. Analysts identified a more advanced variant featuring a heavily obfuscated IRC bot rewritten in Golang, enhanced persistence mechanisms, process-masking capabilities, and dynamically managed credential lists that could be updated on demand.

Credential Strategy Shaped by AI and Developer Habits

The malware's brute-force component relies on curated combinations of common usernames and passwords such as 'myuser:Abcd@123' or 'appeaser:admin123456.' These are not random selections. Many originate from database tutorials, hosting documentation, and vendor examples—materials that have been widely ingested into large language model training corpora. As a result, AI tools frequently reproduce the same defaults in generated configuration snippets, unintentionally standardizing weak credentials across deployments.

Additional usernames in the rotation reference cryptocurrency workflows (such as 'cryptouser,' 'appcrypto,' 'crypto_app,' and 'crypto') or specifically target phpMyAdmin environments, including 'root,' 'wordpress,' and 'wpuser.'

Attackers maintain a relatively small, stable password pool for each campaign, refreshing per-task lists from that base while rotating usernames and niche additions multiple times per week. FTP attacks are treated differently: the bruteforcer binary contains a hardcoded credential set that maps closely to default web-hosting stacks and service accounts.

The Infection Chain and Botnet Capabilities

Observed intrusions most often begin with an internet-exposed FTP service on a XAMPP server. Once access is gained, the attackers upload a PHP web shell. That shell is then used to fetch and execute an updated IRC bot via a shell script tailored to the host's architecture.

After compromise, an infected system can be repurposed in several ways:

• It runs brute-force modules to attempt logins against FTP, MySQL, PostgreSQL, and phpMyAdmin services across the internet.
• It hosts and distributes malicious payloads to newly compromised machines.
• It provides IRC-style command-and-control endpoints or functions as a fallback C2 server to improve botnet resilience.

Direct Evidence of Blockchain-Focused Operations

Further investigation revealed that at least one compromised server was staging a specialized module designed to iterate through a list of TRON blockchain addresses. Using the public tronscanapi.com service, the malware queried account balances to identify wallets holding non-zero funds. This capability strongly suggests deliberate reconnaissance aimed at blockchain projects and crypto-related infrastructure rather than opportunistic scanning alone.

A Persistent Lesson for Defenders

GoBruteforcer illustrates a broader, ongoing security failure: the dangerous intersection of exposed services, weak or recycled credentials, and increasingly automated attack tooling. While the botnet itself is not technically groundbreaking, its operators benefit enormously from the sheer volume of misconfigured servers still accessible on the public internet.

For defenders, this campaign reinforces a familiar but critical message: eliminate default credentials, restrict administrative interfaces, retire legacy stacks, and treat AI-generated deployment examples as untrusted starting points rather than production-ready configurations.