MalwarePublished 4 Sep 2025Updated 4 Oct 2025

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

Source AlienVault OTX General

Description

ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.

Impact

For European organizations, the GhostRedirector threat could lead to unauthorized access and control over Windows servers, particularly those running IIS. This can result in compromised web infrastructure, manipulation of web content, and reputational damage if their websites are used to promote fraudulent or malicious content. The presence of backdoors and rogue accounts increases the risk of further lateral movement within networks, data exfiltration, or use of compromised servers as part of broader malicious campaigns. SEO fraud can also distort legitimate business operations and damage trust with customers and partners. Although the current known infections are outside Europe, the techniques and tools used could be adapted to target European servers, especially in sectors with high IIS usage or those involved in online gambling, marketing, or SEO services. The medium severity rating reflects the threat’s potential to disrupt integrity and availability of web services, as well as the confidentiality risks posed by persistent backdoors and unauthorized access.

Defensive guidance

European organizations should implement targeted detection and response measures focusing on IIS server integrity and user account management. Specifically, they should: 1) Audit IIS modules regularly to detect unauthorized or suspicious modules like Gamshen; 2) Monitor for creation of rogue user accounts and unusual privilege escalations; 3) Apply all relevant security patches promptly, especially those addressing privilege escalation vulnerabilities; 4) Employ endpoint detection and response (EDR) tools capable of identifying stealthy backdoors such as Rungan; 5) Use web application firewalls (WAF) to monitor and block suspicious web traffic and SEO manipulation attempts; 6) Conduct threat hunting exercises focusing on indicators of compromise related to GhostRedirector’s tactics; 7) Harden server configurations by disabling unnecessary IIS features and enforcing least privilege principles; 8) Implement network segmentation to limit lateral movement from compromised servers; and 9) Educate IT staff on emerging threats involving SEO fraud and malicious IIS modules to improve detection capabilities.

Indicators of compromise

Domains 8

868id.com
brproxy.868id.com
gobr.868id.com
q.822th.com
www.881vn.com
www.cs01.shop
xz.868id.com
xzs.868id.com

URLs 10

http://gobr.868id.com/tz.php
http://xz.868id.com/EfsPotato_sign.exe
https://brproxy.868id.com/index_base64.php
https://brproxy.868id.com/tz_base64.php
https://brproxy.868id.com/url/index_base64.php
https://www.cs01.shop
https://xzs.868id.com/EfsNetAutoUser_br.exe
https://xzs.868id.com/iis/IISAgentDLL.dll
https://xzs.868id.com/iis/br/ManagedEngine64_v2.dll
https://xzs.868id.com/link.exe

IP addresses 4

104.233.210.229
103.251.112.11
104.233.192.1
43.228.126.4

Hashes 8

030201090405060708090a0b0c0d0e0f
049c343a9daaf3a93756562ed73375082192f5a8
21e877ab2430b72e3db12881d878f78e0989bb7f
28140a5a29eba098bc6215ddac8e56eacbb29b69
5a01981d3f31af47614e51e6c216bed70d921d60
9dd282184ddfa796204c1d90a46caa117f46c8e1
be2ac4a5156dbd9ffa7a9f053f8fa4af5885be3c
ee22ba5453ed577f8664ca390eb311d067e47786

Community reviews

Loading reviews…