GhostRedirector Hackers Target Windows Servers Using Malicious IIS Module

ESET security researchers have uncovered a sophisticated cyber threat campaign dubbed GhostRedirector that targets Windows servers across multiple countries, compromising at least 65 machines in Brazil, Thailand and Vietnam. The group has developed two custom tools, Rungan, a backdoor for remote command execution, and Gamshen, an IIS module that manipulates Googlebot requests to boost SEO fraud as-a-service by injecting malicious backlinks and content.

Initial access is typically gained via SQL injection, with PowerShell used to download additional tools from a staging server at 868id[.]com. The operators also rely on publicly available exploits such as EfsPotato and BadPotato for privilege escalation, enabling the creation of administrative user accounts to maintain long-term access.

The campaign has a broad geographic footprint, spanning several continents and industries, from healthcare to retail, with victims including Canada, Finland, India, the Netherlands, the Philippines and Singapore, though in smaller numbers. Security researchers assess with medium confidence that GhostRedirector represents a China-aligned threat actor, based on factors like language strings in malware and code-signing certificates issued to Chinese companies. according to ESET security researchers.