New GoBruteforcer attack wave targets crypto, blockchain projects

GoBruteforcer (GoBrut) is a Golang-based botnet targeting exposed FTP, MySQL, PostgreSQL, and phpMyAdmin services. It uses compromised Linux servers to scan random public IPs and perform brute-force login attacks. The malware launches up to 95 brute-forcing threads on x86_64 architectures after a 10-400 second delay, skipping private networks, AWS cloud ranges, and U.S. government networks. Initial compromise often occurs through XAMPP FTP servers with weak default passwords. The infection chain involves uploading web shells, downloading IRC bots, and bruteforcer modules. The FTP module uses 22 hardcoded username-password pairs targeting default accounts in web-hosting stacks. Recent campaigns leverage AI-generated configuration snippets with predictable usernames like 'appuser', 'myuser', and 'operator'. One campaign included TRON wallet-scanning tools targeting approximately 23,000 TRON addresses to identify and drain wallets with non-zero balances.