Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns

GoBruteforcer, a modular Go-written botnet, brute-forces user credentials for FTP, MySQL, PostgreSQL and phpMyAdmin on Linux servers, spreading via a chain of web shells, downloaders and an IRC bot.

According to Check Point Research, the current wave is driven by AI-assisted server deployment examples and legacy stacks like XAMPP, with more than 50,000 Internet-facing hosts potentially vulnerable to GoBruteforcer, alongside millions of exposed database and file‑transfer servers such as roughly 5.7 million FTP servers and 2.23 million MySQL servers.

CPR also observed a crypto-focused campaign on crypto and blockchain project databases, including a compromised host containing approximately 23,000 TRON addresses and TRON and BSC “token-sweep” utilities. The attackers use both publicly available weak credentials and a built-in FTP list, while the C2 delivers per-task credential lists and targets across campaigns that rotate several times a week.

The GoBruteforcer 2025 variant includes a Go-based IRC bot, UPX packing, process masking, and enhanced persistence, with architecture-specific C2 channels and a default set of channels such as #bots and #bots-x86. In its crypto‑campaign, on-chain analysis linked recipient wallets to TRON and BSC accounts, suggesting at least some attacks were successful, though many addresses carried only small residual funds.