GoBruteforcer is a botnet attacking cryptocurrency databases to brute-force user passwords for various services. Its operators exploit weak credentials and misconfigured servers to expand their control, utilizing a mix of common usernames and a persistent malware infrastructure. Recent activities also show attempts to identify blockchain accounts with funds.

A new strain of malware named "Gayfemboy," based on the Mirai botnet, has been identified targeting vulnerabilities in devices from various vendors including DrayTek and TP-Link. The malware has shown evolved techniques for obfuscation, self-protection, and remote control, enabling attackers to gain control over infected systems and conduct DDoS attacks across multiple sectors worldwide.