New Golang-Based Malware Breaches Web Servers Via Brute-Force Attacks

Mar 14, 2023Ravie LakshmananNetwork Security / Botnet

A brand new Golang-based malware dubbed GoBruteforcer has been discovered focusing on internet servers working phpMyAdmin, MySQL, FTP, and Postgres to corral the units right into a botnet.

“GoBruteforcer selected a Classless Inter-Domain Routing (CIDR) block for scanning the community through the assault, and it focused all IP addresses inside that CIDR vary,” Palo Alto Networks Unit 42 researchers mentioned.

“The risk actor selected CIDR block scanning as a method to get entry to a variety of goal hosts on totally different IPs inside a community as an alternative of utilizing a single IP tackle as a goal.”

The malware is principally designed to single out Unix-like platforms working x86, x64 and ARM architectures, with GoBruteforcer making an attempt to acquire entry through a brute-force assault utilizing an inventory of credentials hard-coded into the binary.

If the assault proves to achieve success, an web relay chat (IRC) bot is deployed on the sufferer server to ascertain communications with an actor-controlled server.

GoBruteforcer additionally leverages a PHP internet shell already put in within the sufferer server to glean extra particulars in regards to the focused community.

That mentioned, the precise preliminary intrusion vector used to ship each GoBruteforcer and the PHP internet shell is undetermined as but. Artifacts collected by the cybersecurity firm recommend energetic growth efforts to evolve its ways and evade detection.

The findings are yet one more indication of how risk actors are more and more adopting Golang to develop cross-platform malware. What’s extra, GoBruteforcer’s multi-scan functionality allows it to breach a broad set of targets, making it a potent risk.

“Web servers have at all times been a profitable goal for risk actors,” Unit 42 mentioned. “Weak passwords might result in critical threats as internet servers are an indispensable a part of a corporation. Malware like GoBruteforcer takes benefit of weak (or default) passwords.”