GoBruteforcer feeds on weak defaults from AI-generated configs

Check Point Research, who also took apart VoidLink, dissected GoBruteforcer, a Go-based botnet targeting Linux servers by brute-forcing passwords for FTP, MySQL, PostgreSQL, and phpMyAdmin services. Palo Alto Networks Unit 42 first documented the botnet in March 2023, when it was already going after the same four services with hard-coded credentials and dropping an IRC bot and a PHP web shell. The twist: LLM-generated deployment snippets keep recycling the same default usernames and weak credentials, which researchers say makes the botnet’s job easier, with an estimated 50,000+ vulnerable internet-facing servers. Beyond standard credential stuffing, operators deployed specialized blockchain tools to target crypto projects and execute token-sweep operations, proving that when you combine lazy defaults with cryptocurrency, someone will inevitably help themselves.