US EditionNew China-Aligned Crew Poisons Windows Servers for SEO Fraud
GhostRedirector exploited SQL injection vulnerabilities to install custom malware on at least 65 Windows servers globally, manipulating Google search rankings to promote gambling sites, ESET reported.
- Over the past year, ESET Research identified GhostRedirector, which compromised at least 65 Windows servers mainly in Brazil, Thailand, Vietnam, and the United States.
- By exploiting probable SQL injection flaws, GhostRedirector uses PowerShell to download tools from staging server 868idcom, deploying Rungan, Gamshen, EfsPotato, and BadPotato exploits.
- Technical analysis shows Gamshen IIS module alters responses only for Googlebot, creating artificial backlinks to boost target sites; "The response is modified based on data requested dynamically from Gamshen's C&C server," Fernando Tavella, ESET researcher, wrote.
- ESET has informed affected organizations and is monitoring; compromises spanned education, healthcare, insurance, transportation, technology, retail sectors, mainly in South America and South Asia.
- Analysts note attribution indicators pointing to China-aligned origins with medium confidence, referencing Shenzhen Diyuan Technology Co., Ltd. and similar IIS-based campaigns like IISerpent and DragonRank active from August 2024 to June scan.
13 Articles
13 Articles
A new threat actor related to China and known as GhostRedirector has poisoned Google's search engine, in addition to infecting Windows servers.
Advert: Red Hat ESET's open hybrid cloud identified at least 65 committed Windows servers, mainly in Brazil and Peru, which seeks to manipulate Google's search results to position malicious sites. ESET's research team, a proactive threat detection company, discovered a new malicious actor aligned to China, who has been named GhostRedirector. In June 2025, this malicious actor committed at least 65 Windows servers, mainly in Brazil, Peru, Thailan…
ESET identifies at least 65 committed Windows servers, mainly in Brazil and Per, which seeks to manipulate Google's search results to position malicious sites.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
