A posting to the InfoSec Handlers Diary has provided information on a botnet named GoldBrute. It is currently attempting to brute-force credentials on Internet-accessible RDP servers. The number of servers the botnet is attempting to exploit is reportedly in the region of 1.5 million. If a server is successfully compromised, the server will then download and install the botnet code.
The botnet is written in Java and the required Java runtime is part of the botnet code download. The infected server will communicate with the C&C server using an encrypted (AES) websocket on port 8333 and then scan random IP addresses to locate further systems with exposed RDP services. An interesting feature of the botnet is the manner in which it assigns servers to attempt to brute force with each bot trying only one username and password per target system.
It is recommended that you ensure RDP is NOT open to the internet, you use strong passwords for RDP service, and keep applications and operating systems running at the current released patch level.
Indicators of Compromise
IP Addresses 220.127.116.11 (Download Server) 18.104.22.168 Port 8333 (C&C Server)
Malicious Jar File Name bitcoin.dll
UK based technology professional, with an interest in computer security and telecoms.