GoBruteforcer Botnet Targeting Crypto, Blockchain Projects

GoBruteforcer, a Go-written botnet, is targeting cryptocurrency and blockchain projects in a financially motivated campaign, according to Check Point. The operation recruits Linux servers into a scanning and password brute-forcing network that focuses on internet-exposed services such as FTP, MySQL, phpMyAdmin and PostgreSQL, aided by AI-generated server defaults and weak credentials.

The botnet uses an IRC bot for operator control and a brute-forcer that probes random public IP ranges, with a C&C server pushing targeted services and credential lists that are rotated several times weekly. The infection chain involves an initial compromise via exposed FTP on XAMPP stacks, followed by a web shell that enables further payloads, including the IRC bot, and modules that enumerate TRON blockchain addresses to identify targets.

Notably, GoBruteforcer has utilities to transfer Binance Smart Chain and TRON tokens from victims to attacker wallets, and some recovered wallet addresses appear tied to a legacy blockchain product. 13 January 2026.