GoBruteforcer is a modular botnet that brute-forces passwords on Linux servers, targeting FTP, MySQL, and PostgreSQL services, exploiting AI-generated defaults and weak credentials. Over 50,000 servers may be affected. Its campaigns focus on cryptocurrency databases, utilizing common usernames and weak passwords derived from AI-generated configurations. The botnet operates through a two-part system: an IRC bot for command control and a bruteforcer for password attacks. Its success is bolstered by widespread internet exposure and legacy software vulnerabilities, particularly with misconfigured services like XAMPP. The botnet dynamically updates and expands its reach while targeting specific sectors, including crypto-related services, revealing significant risks in server security.
Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns
