The new GoldBrute botnet tries to break 1,5 million servers with RDP

A botnet scans it προς αναζήτηση μη προστατευμένων μηχανών Windows με ενεργοποιημένη τη σύνδεση πρωτοκόλλου Remote Desktop (RDP).

It's called GoldBrute and it systematically scans a list of over 1,5 million systems, trying to get to them with brute-force attacks. The scan continues even now and GoldBtute is increasing its list of potential targets.

A search on Shodan (internet connected machines search engine) shows that there are about 2,4 million machines accessible on the web with the remote surface (Remote Desktop Protocol).

Ο Renato Marinho of Morphus Labs analyzing GoldBrute's brute-force method, predicts that the συλλέγουν δεδομένα για να πουλήσουν σε hacker φόρουμ ή σε αγορές στο web. Ο ερευνητής αναφέρει ότι τα στοιχεία κατευθύνονται στη διεύθυνση IP, η οποία δείχνει μια τοποθεσία στο New Jersey στις Ηνωμένες Πολies.

GoldBrute Botnet code is quite large, about 80MB, because it includes the full Java Runtime. GoldBrute-infected systems start a web scan for servers with exposed RDP servers and report the results to IP via an encrypted WebSocket connection on port 8333, commonly used for connections .

After sending the addresses to 80 victims, the bot then tries to do so brute-force in these. Interestingly, the bot tries to check only one pair of username and password for each target.

Most likely, this tactic is intended to hide a coordinated Brute-force attack, as the victim will see multiple connection attempts.

While analyzing the GoldBrute botnet, the researcher was able to modify his code in a way that allowed him to store the list of all “host + username + ” on his own computer.

"After 6 hours, we received 2,1 million IP addresses from the bot, of which 1.596.571 are unique. Of course, we did not execute the next phase of the brute-force ".

The systems are distributed worldwide as shown in the map below.

There is nothing innovative in the attack method, but GoldBrute stands out in the way it handles brute-force. The method helps to keep a low profile so that it is not easily perceived. The Best Technology Site in Greecefgns

Subscribe to Blog by Email

Subscribe to this blog and receive notifications of new posts by email.

Written by Dimitris

Dimitris hates on Mondays .....

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).