Chinese Hackers Game Google to Boost Gambling Sites

A professional cybercrime operation likely based in China is using a sophisticated bag of tricks to run an SEO manipulation campaign aimed at artificially boosting the search rankings of various gambling websites. The operation, tracked by ESET as GhostRedirector, compromises Windows Web servers and plants malware tools for privilege escalation, persistence, and to game Google's indexing crawlers.

It began to appear active since at least August 2024 and has affected dozens of websites, with 65 sites compromised to date, mainly in Brazil, Vietnam and Thailand. The threat actors have used an IIS component called Gamshen and a backdoor named Rungan to intercept HTTP requests and inject links that promote the target sites, thereby attempting to boost search rankings through backlinks from compromised sites.

ESET notes that initial access is likely gained by abusing an unpatched SQL injection vulnerability, after which PowerShell downloads further tools such as Gamshen and Rungan, with the campaign expanding across healthcare, education, transportation, insurance, retail and technology sectors. According to ESET, admins should enforce dedicated accounts, strong passwords and MFA for IIS administrators, and ensure native IIS modules are installed only from trusted, signed sources.