GoBrut Botnet: Be aware of a new password cracker virus

Admin
27 May 2023

Botnets are increasing in numbers day by day, managing to infect computers, devices, and programming systems, growing countless victims all over the world. GoBrut is a botnet that is also known as stealth worker malware. It is written in the Go computer programming language (Golang).

Among all other common viruses and malware, a user should also have all information about this stealth virus.

advertisement

Origin of GoBrut

GoBrut computer virus was introduced in first February 2019 and then confirmed in the August 2021 campaign against Synology internet-facing NAS devices and web servers. In 2019, various brute-force attacks launched as malware against CMSs that were secured poorly including Magneto.

The payload was distributed through JS injection in the Synology case. This stealth virus works with coding efficiency, IP addresses, pen testers, and a reasonable learning curve due to its flexibility. GoBrut is popular in Golang scripted in terms of design.

advertisement

How GoBrut infects computers?

Among all these threats and malware uncovered the researches recently that GoBrut is an ELF-based botnet, which is infecting computers and spreading in Windows systems. As it is a type of common virus that is spreading in operating devices.

Like other common computer glitches, Once it connects the computer to a botnet where a series of devices are connected and working together to get a single goal. These botnets work as a brute force that cracked and guesses the password decreasing the internet speed and affecting the whole system processing. The brute force module uses SSH, Content Management Systems (CMS), and MySQL technologies to attack the server.

advertisement

As Gobrut connects to the botnet device is infected and the host will be linked to C2 (Command and Control) server. GoBrut virus is very common and expert in password cracking of any device.

After that, the botnet controller sent the CNC server that works in the solicitation, and that botnet is connected to the mega cart group.

Brute force achieved its target to infect the device and end up its process in user name, password cracking, and stealing the credentials.

This way of GoBrut virus is very interesting for attacking any computer or device.

GoBrut Affected Platforms

If you are thinking that which platforms are mostly affected by Gobrut? There are the following major platforms that are affected in all versions of the Microsoft window server:

advertisement

Targeted content management system

PHP server
Drupal
Magneto
OCart
Unix distribution
Word Press
Joomla
woo

Administration tools

phpMyAdmin
htpasswd
cPanel
web host management

Protocol

SSH
FTP

Database

Postgres
MySql

Network storage

QNAP-NAS

How to prevent of GoBrut virus?

There are the following steps that a user should adopt to remediation from GoBrut virus on their devices;

Don’t open soliciting attachments or click on links
All security products, antivirus software, and operating systems keep up to date
Use strong password policies
Use firewall logs, proxy, and network should be noticed against suspicious activities

After accessing any account, a user should reset all passwords to clean the computer if they notice an infection.