GhostRedirector: A New China-Aligned Threat Targeting Windows Servers for SEO Fraud
TL;DR
Cybersecurity researchers uncovered GhostRedirector, a threat group targeting at least 65 Windows servers mainly in Brazil, Thailand, and Vietnam, using a passive backdoor called Rungan and an IIS module named Gamshen to conduct SEO fraud and maintain long-term access, with suspected links to China.
Topics:technologycybersecurity#cybersecurity#gamshen-iis-module#ghostredirector#rungan-backdoor#seo-fraud#windows-servers
- GhostRedirector Hacks 65 Windows Servers Using Rungan Backdoor and Gamshen IIS Module The Hacker News
- GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes WeLiveSecurity
- New China-aligned crew poisons Windows servers for SEO fraud theregister.com
- New threat group uses custom tools to hijack search results Help Net Security
- GhostRedirector Emerges as New China-Aligned Threat Actor Infosecurity Magazine
Want the full story? Read the original reporting
Read on The Hacker News