Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

ESET researchers have identified a new threat actor, GhostRedirector, targeting Windows servers with custom tools. The group has compromised at least 65 servers, mainly in Brazil, Thailand, and Vietnam, across various sectors. Their arsenal includes Rungan, a passive C++ backdoor, and Gamshen, a malicious IIS module for SEO fraud. GhostRedirector also uses public exploits for privilege escalation and creates rogue user accounts to maintain access. The attacks aim to manipulate Google search results, promoting gambling websites through shady SEO techniques. Evidence suggests GhostRedirector is a China-aligned actor, active since at least August 2024. The campaign demonstrates sophisticated tactics for server compromise and long-term access maintenance.

GhostRedirector is a newly identified threat actor targeting Windows servers with a sophisticated malware campaign primarily aimed at manipulating search engine results to promote gambling websites. The group has compromised at least 65 servers, predominantly in Brazil, Thailand, and Vietnam, but with indicators suggesting potential activity in European countries such as Finland and the Netherlands. The attackers employ custom tools including 'Rungan,' a passive C++ backdoor that allows stealthy long-term access, and 'Gamshen,' a malicious IIS module designed to conduct SEO fraud by manipulating web server responses to influence Google search rankings. GhostRedirector leverages publicly known exploits for privilege escalation to gain higher system privileges and creates rogue user accounts to maintain persistent access. The campaign is notable for its use of advanced tactics to compromise servers, maintain stealth, and achieve long-term footholds. The malware infrastructure includes multiple IP addresses, domains, and URLs used for command and control, payload delivery, and SEO manipulation. The threat actor is believed to be China-aligned and has been active since at least August 2024. While the primary motivation appears financial through SEO fraud and gambling promotion, the use of backdoors and privilege escalation tools indicates potential for broader malicious activities. No CVE identifiers or known exploits in the wild are currently associated with this campaign, but the complexity and persistence mechanisms highlight a significant operational capability.

Detailed information about GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes. Get real-time updates, technical details, and mitigation 

Title	Severity	Type	Source	Date

Threats Tagged 'seo fraud'

Filter Threats

Threats Tagged 'seo fraud'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility