GoBruteforcer Botnet Targets Crypto Project Databases by Exploiting Weak Credentials

GoBruteforcer, also known as GoBrut, has been observed targeting databases of cryptocurrency and blockchain projects to recruit infected hosts into a botnet that can brute-force user passwords for FTP, MySQL, PostgreSQL and phpMyAdmin on Linux servers.

According to Check Point, the campaigns are driven by mass reuse of AI-generated server deployment examples that propagate common usernames and weak defaults, plus the persistence of legacy web stacks such as XAMPP that expose FTP and admin interfaces with minimal hardening. The GoBruteforcer operators reuse a small, stable password pool for each campaign, rotate usernames and niche additions several times a week, and embed a built-in set of credentials for FTP brute-forcing.

Infected hosts can be used to run further brute-force attempts, host payloads for other compromised systems, or serve as back-end C2 endpoints, with one campaign even showing an iteration through a list of TRON blockchain addresses to query balances.

The activity includes a mid-2025 disclosure of a more sophisticated, obfuscated IRC bot and updates to the botnet, and the chain of campaigns observed from December 2025 into January 2026 is said to involve high-volume enumeration of exposed LLM endpoints and misconfigured proxies.