GoBruteforcer is a Golang-based malware that targets cryptocurrency and blockchain project databases through brute-force attacks on FTP, MySQL, PostgreSQL, and phpMyAdmin services on Linux servers. The malware uses internet-exposed FTP services on XAMPP servers as initial access vectors to upload PHP web shells, then downloads and executes IRC bots based on system architecture. It employs heavily obfuscated IRC bots, improved persistence mechanisms, process-masking techniques, and dynamic credential lists. The botnet serves three purposes: running brute-force components, hosting payloads, and acting as C2 infrastructure. One compromised host was found staging a module that queries TRON blockchain addresses for account balances using tronscanapi.com.