Security researchers at Check Point have identified an evolved variant of the GoBruteforcer malware conducting targeted campaigns against cryptocurrency and blockchain platforms. The attacks exploit weak authentication across multiple database services including FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux-based systems.

Root Causes

According to Check Point Research’s recent findings, two primary factors enable these attacks:

  1. AI Training Data Contamination: Large language models trained on database documentation and deployment tutorials now generate code containing the same vulnerable default credentials present in their training datasets. This creates a self-perpetuating cycle where AI-assisted development inadvertently propagates security weaknesses.
  2. Legacy Stack Vulnerabilities: Outdated web server configurations, particularly XAMPP deployments, continue operating with exposed administrative interfaces and inadequate security hardening.

Technical Evolution

Historical Context

GoBruteforcer (GoBrut) emerged in early 2023 targeting Unix-like systems across x86, x64, and ARM architectures. Initial variants deployed IRC-based command infrastructure alongside web shells and credential-scanning modules.

By September 2025, researchers discovered overlap between GoBruteforcer infrastructure and the SystemBC malware ecosystem, indicating shared botnet resources.

Recent Enhancements

Mid-2025 samples demonstrate significant technical sophistication:

  • Rewritten IRC Component: Core bot functionality migrated to heavily obfuscated Golang implementation
  • Enhanced Evasion: Advanced process masquerading and improved persistence mechanisms
  • Dynamic Credential Management: Operators maintain rotating credential pools that refresh multiple times weekly, allowing campaigns to pivot between target sectors

Attack Methodology

Credential Selection Strategy

The malware employs curated username-password combinations derived from multiple sources:

  • Generic weak credentials (myuser:Abcd@123, appeaser:admin123456)
  • Cryptocurrency-specific accounts (cryptouser, appcrypto, crypto_app)
  • Common CMS defaults (root, wordpress, wpuser for phpMyAdmin)

FTP attacks utilize a static credential set hardcoded within the binary, specifically targeting web hosting environments and default service accounts.

Infection Chain

  1. Initial Compromise: Scanning identifies internet-exposed FTP services, particularly XAMPP installations
  2. Web Shell Deployment: Successful authentication enables PHP web shell upload
  3. Bot Installation: Architecture-specific shell scripts download and execute the IRC bot payload
  4. Botnet Integration: Compromised hosts assume one of three operational roles:
    • Credential brute-forcing nodes targeting FTP, MySQL, PostgreSQL, and phpMyAdmin services
    • Payload distribution servers for lateral movement
    • Backup command-and-control infrastructure ensuring operational resilience

Cryptocurrency-Focused Operations

Analysis of compromised infrastructure revealed specialized modules querying TRON blockchain addresses via tronscanapi[.]com to identify wallets containing funds, confirming deliberate targeting of blockchain-related systems.

Broader Threat Landscape

Concurrent threat activity involves systematic internet-wide scanning for misconfigured proxy servers that could facilitate unauthorized access to commercial LLM platforms.

  1. Campaign One (October 2025 – January 2026): Exploited server-side request forgery vulnerabilities in Ollama model pulls and Twilio SMS webhooks. Attribution evidence suggests security research or bug bounty operations.
  2. Campaign Two (December 28, 2025 onward): High-intensity enumeration targeting LLM API endpoints from multiple providers including Alibaba, Anthropic, DeepSeek, Google, Meta, Mistral, OpenAI, and xAI. Over eleven days, source IPs 45.88.186[.]70 and 204.76.203[.]125 generated 80,469 scanning sessions across 73+ model endpoints.

Implications

This campaign highlights the compounding security challenges created when AI-generated code propagates vulnerable defaults, legacy infrastructure remains unpatched, and automated attack tools continue advancing in sophistication. Organizations must address exposed services, enforce strong authentication, and audit AI-assisted development outputs for security weaknesses.

References