Threat actor
GhostRedirector
China
Tracked by CyberSIXT since 4 Sep 2025
- Articles · all time
- 2
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
Names and sources
- GhostRedirector
- Named by CyberSIXT coverage
- GhostRedirector
- Named by Malpedia · ghostredirector
- GhostRedirector
- Named by MISP Galaxy · a298949b-4f98-4432-8b5d-ca0503ef3c2d
- a298949b-4f98-4432-8b5d-ca0503ef3c2d
- Named by CyberSIXT coverage
Attributed facts
- origin
- China (MISP Galaxy · a298949b-4f98-4432-8b5d-ca0503ef3c2d)
- GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS ModuleThe Hacker News
- GhostRedirector Hackers Target Windows Servers Using Malicious IIS ModuleGBHackers · first in our coverage