GoBruteforcer Returns: How AI Code Snippets Fueled a 50,000-Server Botnet

A Check Point Research analysis describes a 2025 evolution of the GoBruteforcer botnet that brute-forces common Linux services by exploiting widespread reuse of weak, AI-generated default configurations; the threat combines large-scale credential stuffing with evasion techniques (Go-based obfuscated modules, process-name masking via prctl, IP blacklists to avoid DoD/cloud ranges) and has been observed targeting crypto project databases with tools for sweeping funds, with evidence of successful theft and an estimated >50,000 potentially vulnerable internet-facing servers.