The GoBruteforcer malware is a sophisticated botnet targeting cryptocurrency projects and Linux servers by exploiting weak credentials and AI-generated server defaults. This Golang-based malware is adept at brute-forcing widely used services such as FTP, MySQL, PostgreSQL, and phpMyAdmin, utilizing credentials frequently found in tutorials and large language model (LLM)-generated code.
Once a server is compromised, it can take on different roles within the botnet. Infected hosts may scan for new victims, serve malicious payloads, or even function as backup command-and-control servers. Recent campaigns show a particular focus on the TRON blockchain, as the malware attempts to identify accounts with financial assets.
The 2025 variant of GoBruteforcer has introduced several advancements, including a heavily obfuscated IRC bot written in Go, improved persistence mechanics, and dynamic credential lists sourced from C2 servers. The threat actors have optimized their approach by exploiting weak passwords and default credentials, which are prevalent in AI-generated configurations and legacy systems such as XAMPP.
Apart from expanding the botnet, attackers use compromised systems for data theft and backdoor creation. To maintain their operations’ stealth, the malware employs techniques like process masking, cron-based persistence, and architecture-specific worker pools. Moreover, the botnet scans millions of exposed database servers to broaden its reach.
Evidence points towards a consistent crypto-focused strategy, particularly against blockchain databases, while separate threat actors scout for misconfigured proxy servers to leverage commercial LLM services. This highlights the critical importance of securing credentials and properly configuring server environments to safeguard against such sophisticated threats.

Collections

GoBruteforcer is a Golang-based botnet exploiting weak credentials and AI-generated defaults to compromise Linux servers and cryptocurrency projects. It brute-forces services like FTP, MySQL, PostgreSQL, and phpMyAdmin, then uses infected hosts for scanning, payload delivery, or C2 operations. The 2025 variant features obfuscated IRC bots, dynamic credential lists, and persistence mechanisms. Attackers specifically target TRON blockchain accounts and scan millions of exposed database servers while employing stealth techniques like process masking and cron-based persistence.

GoBruteforcer Botnet: Exploiting Weak Credentials and AI Defaults in Crypto-Targeted Campaigns