GhostRedirector Targets Windows Servers Globally for SEO Fraud

GhostRedirector: China-Aligned Threat Actor Targeting Windows Servers

Summary

First detected in August 2024, GhostRedirector is a newly discovered China-aligned threat actor that has compromised at least 65 Windows servers globally by mid-2025. Active in Brazil, Peru, Thailand, Vietnam, the United States, Canada, Finland, India, Netherlands, Philippines, and Singapore, the group targets industries including education, healthcare, insurance, transportation, technology, and retail.

The attacks employ a modular toolkit including Rungan (C++ backdoor) and Gamshen (IIS trojan), which allow covert command execution and SEO fraud by injecting backlinks into Google crawler traffic. Supporting tools like Zunput and misused remote utilities ensure resilience and persistence. This financially motivated campaign demonstrates a sophisticated strategy to monetize compromised infrastructure at scale.

Attack Details

• Initial Access: Exploitation of SQL injection flaws in public-facing applications. Malicious payloads are pulled using LOLBins like PowerShell and CertUtil.

• Privilege Escalation: Public exploits such as EfsPotato and BadPotato, sometimes signed with legitimate Chinese-issued certificates, enable creation of admin accounts and persistent access.

• Core Malware Tools:

  • Rungan: A passive backdoor DLL listening for crafted HTTP requests, enabling command execution.

  • Gamshen: An IIS trojan manipulating Googlebot traffic to inject backlinks to gambling sites, enabling stealthy SEO poisoning.

• Supporting Utilities:

  • Zunput for deploying webshells into dynamic directories.

  • Legitimate but misused tools such as GoToHTTP for remote access.

Attribution clues such as Chinese-language strings, code-signing certificates, and embedded credentials strongly indicate Chinese alignment. Despite this, the campaign appears financially motivated, focusing on backdoor persistence, SEO fraud, and monetization.

Recommendations

• Prevent Initial Access: Patch web applications and databases to close SQL injection flaws. Deploy WAFs and enforce input validation.

• Detect Privilege Escalation: Monitor for abnormal admin account creation, credential changes, and binaries signed with suspicious certificates.

• Remove Persistence: Inspect IIS servers for rogue DLLs (e.g., miniscreen.dll) and scan for webshells in dynamic directories. Monitor scheduled tasks and services for anomalies.

• Mitigate SEO Fraud: Audit IIS modules and detect discrepancies between crawler and user-served content. Monitor outbound traffic for C2 communication with malicious domains.

Indicators of Compromise (IoCs)

SHA1 Hashes

• EE22BA5453ED577F8664CA390EB311D067E47786

• 677B3F9D780BE184528DE5967936693584D9769A

• 5D4D7C96A9E302053BDFAF2449F9A2AB3C806E63

• 28140A5A29EBA098BC6215DDAC8E56EACBB29B69

• 371818BDC20669DF3CA44BE758200872D583A3B8

• 9DD282184DDFA796204C1D90A46CAA117F46C8E1

• 87F354EAA1A6ED5AE51C4B1A1A801B6CF818DAFC

• 5A01981D3F31AF47614E51E6C216BED70D921D60

• 6EBD7498FC3B744CED371C379BA537077DD97036

Filenames

• SitePut.exe, EfsNetAutoUser.exe, NetAutoUser.exe, miniscreen.dll, auto.exe, auto_sign.exe, DotNet4.5.exe, link.exe, ManagedEngine32_v2.dll, ManagedEngine64_v2.dll

IPv4 Addresses

• 104[.]233[.]192[.]1

• 104[.]233[.]210[.]229

• 43[.]228[.]126[.]4

• 103[.]251[.]112[.]11

Domains

• xzs[.]868id[.]com

• xz[.]868id[.]com

• q[.]822th[.]com

• www[.]881vn[.]com

• gobr[.]868id[.]com

• brproxy[.]868id[.]com

• www[.]cs01[.]shop

MITRE ATT&CK TTPs

• Initial Access: T1190 (Exploit Public-Facing Applications)

• Execution: T1059 (Command and Scripting Interpreter), T1059.001 (PowerShell), T1059.003 (Windows Command Shell)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation), T1112 (Modify Registry)

• Persistence: T1546 (Event Triggered Execution), T1027.009 (Embedded Payloads)

• Defense Evasion: T1027 (Obfuscation), T1140 (Deobfuscate/Decode Files)

• Discovery: T1083 (File and Directory Discovery)

• Credential Access: TA0006

• Command & Control: T1071.001 (Web Protocols), T1090 (Proxy), T1008 (Fallback Channels)

• Impact: T1565 (Data Manipulation), T1499 (Endpoint DoS)

• Resource Development: T1583 (Acquire Infrastructure), T1587.001 (Malware Development), T1588.003 (Code Signing Certificates)

• Collection: T1219 (Remote Access Software), T1119 (Automated Collection)

References

• ESET Research – GhostRedirector Poisons Windows Servers