✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Eight Exploits Used in BlackSquid Attacks

June 10, 2019
Rewterz

Rewterz Threat Alert – Over 185,000 Payment Card Details Stolen by MageCart

June 10, 2019

Rewterz Threat Alert – GoldBrute Botnet Brute Forcing 1.5 Million RDP Servers

Severity

Medium

Analysis Summary

A botnet named GoldBrute. It is currently attempting to brute-force credentials on Internet-accessible RDP servers. The number of servers the botnet is attempting to exploit is reportedly in the region of 1.5 million. If a server is successfully compromised, the server will then download and install the botnet code. The botnet is written in Java and the required Java runtime is part of the botnet code download. The infected server will communicate with the C&C server using an encrypted (AES) websocket on port 8333 and then scan random IP addresses to locate further systems with exposed RDP services. An interesting feature of the botnet is the manner in which it assigns servers to attempt to brute force with each bot trying only one username and password per target system.

Impact

Credential theft

Indicators of Compromise

IP(s) / Hostname(s)

  • 104[.]248[.]167[.]144
  • 104[.]156[.]249[.]231

Malware Hash (MD5/SHA1/SH256)

  • af07d75d81c36d8e1ef2e1373b3a975b9791f0cca231b623de0b2acd869f264e

Remediation

  • Ensure strong RDP passwords.
  • Ensure RDP is not connected to the internet.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo