GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet

A new report from Check Point Research details the 2025 evolution of the GoBruteforcer botnet, which targets Linux servers running common services such as MySQL, FTP and phpMyAdmin. The researchers estimate that more than 50,000 Internet-facing servers may be vulnerable to this latest wave, which combines old-school brute-forcing with evasion tactics.

Although GoBruteforcer itself isn’t AI-powered, its success is fueled by the habits of developers using AI tools, with large language models trained on public documentation regurgitating weak default configuration snippets. The botnet’s infection chain features an IRC module rewritten in Go and uses a clever process-masking approach to masquerade as legitimate system processes, including changing the short process name via prctl with PR_SET_NAME.

It also employs an intelligent IP generation system and a built-in blacklist of 13 /8 blocks historically associated with the DoD to avoid detection, and it avoids major cloud provider ranges such as AWS. According to Check Point Research, the 2025 variant threatens thousands of servers and highlights how low-hanging-fruit misconfigurations can drive large-scale compromise.