Rewterz Threat Alert -New Golang-Based Botnet GoBruteforcer Breaches Web Servers – Active IOCs

Severity

High

Analysis Summary

According to researchers, a Golang-based botnet named GoBruteforcer has been discovered, which is specifically targeting web servers running FTP, MySQL, phpMyAdmin, and Postgres services. This botnet is designed to carry out brute-force attacks, which involve trying out multiple username and password combinations until it finds the correct one to gain unauthorized access to a target system. 

Golang, also known as Go, is a programming language that has gained popularity in recent years due to its simplicity and efficiency. Unfortunately, cybercriminals have also been adopting Golang to create new and sophisticated malware.

Botnets are networks of compromised devices, which are controlled by a single attacker or group of attackers. Botnets can be used for a variety of malicious purposes, including DDoS attacks, spam campaigns, and credential stuffing attacks, which is likely the goal of the GoBruteforcer botnet.

“Malware like GoBruteforcer takes advantage of weak (or default) passwords” mentioned in their blog. Credential stuffing attacks involve using stolen or leaked usernames and passwords to gain unauthorized access to accounts. By targeting web servers running FTP, MySQL, phpMyAdmin, and Postgres services, the GoBruteforcer botnet is likely attempting to gain access to sensitive data stored on those servers, including customer information, financial data, and intellectual property.

The GoBruteforcer botnet targets all IP addresses within a chosen Classless Inter-Domain Routing (CIDR) block, which is a range of IP addresses. The botnet then uses a multiscan module to scan for hosts inside the CIDR block. Once identified, the botnet launches brute force attacks to try and gain unauthorized access to these servers. The botnet targets x86, x64, and ARM processor architectures, and experts discovered that it communicates with the attacker’s server via an internet relay chat (IRC) bot on the victim server.

“Once a host is found, GoBruteforcer tries to get access to the server via brute force. After achieving access, GoBruteforcer deploys an IRC bot containing the attacker’s URL. Later, GoBruteforcer also tries to query the victim system using a PHP web shell.”

They reported, the botnet scans for any open port 80 to target phpMyAdmin services, and for MySQL and Postgres services, the malware scans for open ports 3306 and 5432 and pings the host’s database with a certain username and password.

When targeting FTP services, the malware checks for open port 21 and attempts to authenticate using the Goftp library, which is an FTP client package for Golang. This approach is known as a brute-force attack, where the botnet tries out multiple combinations of usernames and passwords until it finds the correct one to gain unauthorized access to the server.

“The GoBruteforcer bot comes with a multiscan capability, which gives it a wide range of targets that it can use to get into a network. GoBruteforcer also seems to be in active development, so attackers could change the techniques they use to target web servers in the near future”, they conclude.

Overall, the impact of GoBruteforcer highlights the importance of implementing strong password policies, regularly updating software, and utilizing security measures such as multi-factor authentication to protect web servers from brute-force attacks and other types of cyber threats.

Impact

• Unauthorized Access
• Harvest Web Servers
• Cracking Of Passwords

Indicators of Compromise

MD5

• c271f586d574e6f2ad87e9339835b172
• 45172413e29114dc3820d7e5e2b08b4b
• ffeb1d82987d745daf3c9e59f7ce7d37
• 207d8d8496f174396849c8514ce28bee
• b6134c83fbb3ef6fdff045463038969a

SHA-256

• de7994277a81cf48f575f7245ec782c82452bb928a55c7fae11c2702cc308b8b
• 602129f00bb002f07db07affa78d46f67bd0b2c8fb0867ea2da5fc3e73dd2665
• acc705210814ff5156957c028a8d6544deaca0555156504087fdc61f015d6834
• 426b573363277554c7c8a04da524ddbf57c5ff570ea23017bdc25d0c7fd80218
• ebe11121aafdac5d8f2eecba710ba85efa31617a5eb825ba2e89e23379b26b84

SHA-1

• c8325b7177ab88d9d3ab343c983e0edef83bcaf8
• 5f441ee978ce4671f2315d5967308960ac04f140
• 5c5a3b1c061eca1aee48f787995adf0eedf99e78
• c396af4cc8bea7bd33abd0e5d1b2419fc6264e3d
• 4d11f540cc98666361d3d5b18ddf2f5e54fcfa34

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• ?Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Implement security measures such as intrusion detection and prevention systems, web application firewalls, and network segmentation to further reduce the risk of successful attacks.
• One of the most effective ways to prevent brute-force attacks is to enforce strong password policies that require users to create complex and unique passwords. This can include requiring a minimum length and complexity of passwords, and regular password changes.
• Implementing MFA can significantly increase security by requiring additional factors beyond passwords to access sensitive systems or applications.
• Limiting the number of login attempts per user account and per IP address can help prevent brute-force attacks by slowing down or blocking repeated login attempts.