ESET Discovers China-Linked SEO Fraud Campaign GhostRedirector
Cybersecurity firm ESET has uncovered a sophisticated SEO fraud campaign, dubbed GhostRedirector, carried out by a China-aligned group. The campaign, active since August 2024, has compromised at least 65 Windows servers worldwide, primarily in Brazil, Peru, Thailand, Vietnam, and the United States. The group's activities involve promoting gambling websites, particularly those targeting Portuguese speakers.
GhostRedirector has been deploying two previously undocumented backdoors, Rungan and Gamshen, to facilitate its operations. Rungan allows remote command execution, providing the group with extensive control over compromised systems. Gamshen, on the other hand, manipulates Google search rankings to boost the visibility of targeted gambling websites. The group has also created privileged accounts on targeted servers, posing a significant risk for further infections or reinfection.
The campaign, known as Gamshen, is an 'SEO fraud-as-a-service' scheme embedded directly into Microsoft's Internet Information Services (IIS) web server. This deep access to traffic makes Gamshen harder to detect and enables it to manipulate search results effectively. ESET noted some overlap in victim geographies and targeted sectors with a previous China-linked campaign, DragonRank, but believes they are not connected.
The GhostRedirector campaign, carried out by a China-aligned group, has compromised at least 65 Windows servers worldwide. The group's activities involve promoting gambling websites, with victims coming from various industries. ESET assesses the campaign with medium confidence to be China-aligned. The group's use of previously undocumented backdoors and privileged accounts poses a significant threat, and organizations are advised to remain vigilant against such campaigns.
Read also:
- Planned construction of enclosures within Görlitzer Park faces delays
- Controversy resurfaces following the elimination of diesel filter systems at Neckartor: A renewed conflict over the diesel restriction policy
- Foreign financial aid for German citizens residing abroad persists
- Following the fatal accident on Canal Street in Chinatown, New York City initiates long- desired safety enhancements.
