GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module

Cybersecurity researchers have disclosed a previously undocumented threat cluster named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The attacks, per ESET, deployed a passive C++ backdoor called Rungan and a native Internet Information Services (IIS) module codenamed Gamshen, with the threat actor believed active since at least August 2024.

According to ESET researcher Fernando Tavella, Gamshen provides SEO fraud as-a-service by manipulating search engine results to boost the ranking of a target website, while it only alters responses for Googlebot and does not affect regular visitors. The group’s targets span multiple countries and sectors, including education, healthcare, insurance, transportation, technology, and retail, with activity described as indiscriminate.

It is assessed with medium confidence that GhostRedirector is a China-aligned actor, based on hard-coded Chinese strings in the code, a code-signing certificate issued to Shenzhen Diyuan Technology Co., Ltd., and the use of the password “huang” for a created user on compromised machines.