Summary:[/subscribe_to_unlock_form]
Summary:[emaillocker id="1283"]
A recently found Golang-based botnet malware searches for and attacks web servers running the phpMyAdmin, MySQL, FTP, and Postgres services. The malware is compatible with the x86, x64, and ARM architectures, according to researchers. In order to break into insecure *nix devices, GoBruteforcer will brute force accounts using weak or default passwords. For successful execution, the samples require special conditions on the victim system like specific arguments being used and targeted services already being installed (with weak passwords).
The malware begins searching for the phpMyAdmin, MySQL, FTP, and Postgres services for each targeted IP address. It will try to log in with hard-coded credentials once it discovers an open port that is allowing connections. Once inside, it launches a PHP web shell on servers hosting other targeted services or an IRC bot on compromised phpMyAdmin systems. GoBruteforcer will connect to its command-and-control server in the subsequent phase of the attack and wait for commands to be sent by the previously installed IRC bot or web shell.
Execution Flow
The botnet has a wide range of targets to infiltrate networks since it uses a multiscan module to discover potential victims within a Classless Inter-Domain Routing (CIDR). GoBruteforcer selects a CIDR block and will target all IP addresses within that range before searching for IP addresses to attack. The malware expands the scope of the attack by using CIDR block scanning to gain access to a wide variety of hosts on numerous IP addresses rather than focusing on a single IP address. GoBruteforcer is probably still in active development, and its developers anticipate that its users will modify their strategies and the malware's capacity to target web servers while evading security measures.
This malware has been used to remotely deliver a wide range of malware payloads, including coinminers. It is still suspected that GoBruteforcer is still in development, therefore early infection vectors or payloads might modify in the near future.
Threat Profile:
| Tactic | Technique Id | Technique |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Execution | T1204 | User Execution |
| Persistence | T1505 | Server Software Component |
| Defense Evasion | T1027 | Obfuscated Files or Information |
| T1078 | Valid Accounts | |
| Credential Access | T1110 | Brute Force |
| Discovery | T1046 | Network Service Discovery |
References:
The following reports contain further technical details:
[/emaillocker]