Ankura CTIX FLASH Update - March 14, 2023

Malware Activity

New "GoBruteforcer" Malware Targets Web Servers in Brute-Force Attacks

"GoBruteforcer", a newly discovered Golang malware, has been observed being hosted on a legitimate website and targeting web servers specifically running Postgres, phpMyAdmin, MySQL, and FTP. Researchers detailed that the malware operators utilize a Classless Inter-Domain Routing (CIDR) block during their attack to scan the network and target all IP addresses found within the CIDR range. This method is used to target a wide array of hosts on various IP addresses as opposed to a single IP address. GoBruteforcer singles out Unix-like devices running specific architectures and attempts to obtain access through brute-force attacks using hard-coded credentials contained in the binary. The goal of this malware is to gather the devices into a botnet, which uses an internet relay chat (IRC) bot on the victim device for command-and-control (C2) communications. Researchers