Golang-Based Botnet GoBruteforcer targets web servers

A recently discovered Golang-based botnet, dubbed GoBruteforcer, is targeting web servers running FTP, MySQL, phpMyAdmin, and Postgres services

Researchers from Palo Alto Networks Unit 42 recently discovered a Golang-based botnet, tracked as GoBruteforcer, which is targeting web servers running FTP, MySQL, phpMyAdmin, and Postgres services.

In order to compromise a target system, the samples require special conditions on it, such as the use of specific arguments and targeted services already being installed (with weak passwords).

GoBruteforcer targets all IP addresses within a chosen Classless Inter-Domain Routing (CIDR) block, then attempt to compromise the identified servers with brute force attacks. The botnet uses a multiscan module to scan for the hosts inside a CIDR for its attack.

Once the multi-scan module has identified open ports for targeted services, it performs a brute-force attack against the server using a set of credentials.

The botnet targets x86, x64 and ARM processor architectures, experts noticed that it relies on an internet relay chat (IRC) bot on the victim server to communicate with the attacker’s server.

“Once a host is found, GoBruteforcer tries to get access to the server via brute force. After achieving access, GoBruteforcer deploys an IRC bot containing the attacker’s URL.” reads the analysis published by Palo Alto Networks. “Later, GoBruteforcer also tries to query the victim system using a PHP web shell.”

Unit 42 has yet to determine the initial vector of the GoBruteforcer and the PHP web shell campaign is still unknown.

The researchers believe that the botnet is in active development, the bot samples analyzed by Palo Alto Networks are packed with UPX Packer.

The experts reported that the bot scans for any open port 80 to target phpMyAdmin services. For MySQL and Postgres services, the malware scans for open ports 3306 and 5432, then pings the host’s database with a certain username and password. When targeting FTP services, the malware checks for open port 21, and then attempts to authenticate using the Goftp library, which is an FTP client package for Golang.

“Malware like GoBruteforcer takes advantage of weak (or default) passwords.” Palo Alto Networks concludes. “The GoBruteforcer bot comes with a multiscan capability, which gives it a wide range of targets that it can use to get into a network. GoBruteforcer also seems to be in active development, so attackers could change the techniques they use to target web servers in the near future.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, botnet)