Skuggaheimar/Threat Intelligence/GoBrut
GOBRUT
GOBRUT
MALWARE
ECRIME
Threat IntelligenceMalwareApril 26, 2025•15 min read

GoBrut: Threat Intelligence Profile

Go-based brute force tool

Scroll

GoBrut (also known as GoBrut) is a malware active since 2019. Go-based brute force tool. Key characteristics include: SSH/FTP/WordPress brute forcing, Go-based, botnet-distributed credentials.

Overview & Background

Go-based brute force tool. First identified in 2019, this threat is attributed to eCrime.

Threat Assessment

GoBrut remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this malware.

Technical Analysis

GoBrut employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against GoBrut

Mjolnir Security provides detection and response capabilities against GoBrut and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for GoBrut indicators and TTPs within your environment.
  • Threat Intelligence Monitor GoBrut campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: April 26, 2025
Related Reports
Malware

Cobalt Strike: When Red Team Tools Become the Adversary's Arsenal

Read Report →
Malware

RedLine Stealer: The Infostealer That Fueled a Cybercrime Empire

Read Report →