A botnet scans the internet for unprotected Windows machines with the protocol connection enabled Remote Desktop Protocol (RDP).
It's called GoldBrute and it systematically scans a list of over 1,5 million systems, trying to access them with brute-force attacks. The scan is still going on and GoldBtute is increasing its list of possible targets.
A search on Shodan (web-based search engine) shows that there are approximately 2,4 million web-accessible engines with Remote Desktop Protocol enabled.
Ο Renato Marinho of Morphus Labs analyzing GoldBrute's brute-force method, predicts that the hackers συλλέγουν δεδομένα για να πουλήσουν σε hacker φόρουμ ή σε αγορές στο dark web. Ο ερευνητής αναφέρει ότι τα στοιχεία κατευθύνονται στη address IP 104.156.249.231, which points to a location in New Jersey in the United States.
GoldBrute Botnet code is quite large, about 80MB, because it includes the full Java Runtime. GoldBrute-infected systems start a web scan for servers with exposed RDP servers and report the results to IP 104.156.249.231 via an encrypted WebSocket connection on port 8333, commonly used for Bitcoin connections.
After sending the addresses to 80 victims, the bot then tries to do so brute-force in these. Interestingly, the bot tries to check only one username and password pair access, for each target.
Most likely, this tactic is intended to hide a coordinated Brute-force attack, as the victim will see multiple connection attempts.
At analysis of the GoldBrute botnet, the researcher was able to modify his code in a way that allowed him to store the list of all “host + username + password” on his own computer.
"After 6 hours, we received 2,1 million IP addresses from the bot, of which 1.596.571 are unique. Of course, we did not execute the next phase of the brute-force ".
The systems are distributed worldwide as shown in the map below.
There is nothing innovative in the attack method, but GoldBrute stands out in the way it handles brute-force. The method helps to keep a low profile so that it is not easily perceived.
