“GoBruteforcer”, a newly discovered Golang malware, has been observed being hosted on a legitimate website and targeting web servers specifically running Postgres, phpMyAdmin, MySQL, and FTP. Researchers detailed that the malware operators utilize a Classless Inter-Domain Routing (CIDR) block during their attack to scan the network and target all IP addresses found within the CIDR range. This method is used to target a wide array of hosts on various IP addresses as opposed to a single IP address. GoBruteforcer singles out Unix-like devices running specific architectures and attempts to obtain access through brute-force attacks using hard-coded credentials contained in the binary. The goal of this malware is to gather the devices into a botnet, which uses an internet relay chat (IRC) bot on the victim device for command-and-control (C2) communications. Researchers emphasized that GoBruteforcer is currently in active development and it is likely that its tactics, techniques, and procedures (TTPs) will advance in the future. It is recommended that administrators ensure that their infrastructure, especially web servers in this instance, have strong passwords to combat against brute-force attacks. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.