Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

GoBruteforcer: Golang-Based Botnet Actively Harvests Web Servers

Summary: Unit 42 researchers found a new Golang-based botnet sample they named GoBruteforcer, hosted on a legitimate website with binaries for x86, x64 and ARM architectures, that scans a CIDR block for web servers running phpMyAdmin, MySQL, FTP and Postgres and brute-forces them using hard-coded credentials. On success it deploys an IRC bot that registers itself in cron and communicates with the attacker's C2, and the researchers also found a PHP web shell with reverse shell, bind shell and packet crafter capabilities already on the victim server.

Bottom line: The malware only needs weak or default passwords on services like phpMyAdmin, MySQL, FTP and Postgres to get in, and an older sample that targeted only phpMyAdmin sat on VirusTotal with zero detections for months.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related