GoBruteforcer Botnet Targets 50K-plus Linux Servers

Researchers describe a souped‑up GoBruteforcer botnet that preys on Linux servers with weak credentials, including attacking services such as FTP, MySQL, Postgre, and phpMyAdmin. On Jan 7, Check Point Research detailed the modular botnet, whose compromised servers are turned into nodes that then launch brute‑force campaigns against other systems.

The campaign is driven by financially motivated threat actors, with aims including data theft, selling initial access, and, more recently, stealing cryptocurrency, according to Check Point. More than 50,000 Internet‑facing servers may be vulnerable to GoBruteforcer, researchers noted. The attackers rely on common usernames and weak defaults, aided by AI‑generated deployment examples, and the latest variants feature an obfuscated Go IRC bot, persistence improvements, and dynamic credential lists.

Researchers emphasise that securing credentials, hardening defaults, and ongoing exposure management are essential as generative AI lowers barriers to insecure server configurations. according to Check Point Research.