Quick Summary
A new wave of GoBruteforcer botnet malware attacks is targeting cryptocurrency and blockchain projects by exploiting exposed servers. Check Point researchers estimate over 50,000 internet-facing servers may be vulnerable, often due to weak default passwords on FTP servers running XAMPP. The botnet employs brute-force login attacks on services like MySQL and phpMyAdmin, leading to potential compromises of sensitive cryptocurrency data.
The Securityish Brief
The GoBruteforcer botnet, also known as GoBrut, is a Golang-based malware that primarily targets exposed FTP, MySQL, PostgreSQL, and phpMyAdmin services. Recent reports indicate that this botnet is exploiting vulnerabilities in over 50,000 internet-facing servers, particularly those running XAMPP, which often come with weak default passwords. Attackers typically gain initial access through these FTP servers, using standard accounts and weak credentials.
Once access is obtained, attackers can upload web shells to the webroot, allowing them to execute further malicious activities. The infection chain often includes downloading an IRC bot and a bruteforcer module, which initiates brute-force login attempts on various services.
In a recent campaign, the GoBruteforcer botnet was linked to attacks on cryptocurrency wallets, specifically targeting TRON and Binance Smart Chain. Attackers utilized a file containing approximately 23,000 TRON addresses to drain wallets with non-zero balances.
Why This Matters for Your Security
This wave of attacks highlights the risks associated with using AI-generated deployment guides, which often lead to weak and predictable default usernames and passwords. Common usernames such as appuser and myuser frequently appear in configurations generated by large language models, making systems vulnerable to password-spraying attacks.
Organizations should be particularly vigilant about outdated server stacks like XAMPP, which continue to ship with default credentials and open FTP services. These vulnerabilities can expose webroot directories, enabling attackers to drop web shells and execute further attacks.
To mitigate these risks, administrators need to ensure they are not using AI-generated deployment configurations and should implement strong, unique passwords for all accounts. Regularly checking for exposed services on FTP, phpMyAdmin, MySQL, and PostgreSQL is also crucial.
Replacing outdated software stacks with more secure alternatives can significantly reduce the attack surface and enhance overall security posture against threats like GoBruteforcer.
Key Takeaways
- Check and update all default passwords on FTP, MySQL, and PostgreSQL services to strong, unique passwords.
- Avoid using AI-generated deployment guides that may lead to weak configurations.
- Regularly scan for exposed services on your servers to identify vulnerabilities.
- Consider replacing outdated software stacks like XAMPP with more secure alternatives.
- Monitor cryptocurrency wallets for unauthorized access or suspicious activity.
Key Terms & Concepts
- GoBruteforcer: In this article, GoBruteforcer refers to a Golang-based botnet that targets exposed servers to carry out brute-force login attacks.
- XAMPP: XAMPP is an open-source cross-platform web server solution stack package that is often used for deploying web applications.
- web shell: A web shell is a script that can be uploaded to a web server to enable remote administration of the server.
- brute-force login attacks: Brute-force login attacks involve systematically checking all possible passwords until the correct one is found.
Read the original article here: https://www.bleepingcomputer.com/news/security/new-gobruteforcer-attack-wave-targets-crypto-blockchain-projects/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
