dynamic content

A cybercrime group named GhostRedirector has infiltrated at least 65 Windows servers worldwide, using undocumented malware to manipulate Google search rankings for gambling sites. The group's activities began in December, with indications of operation since at least August 2024. They employ two malware variants, Rungan (a C++ backdoor) and Gamshen (an IIS trojan), to execute SEO fraud by altering website responses to Googlebot and creating fake backlinks. Most compromised servers are located in Brazil, Peru, Thailand, Vietnam, and the United States, with a focus on South America and South Asia. The initial breach likely occurred via an SQL injection vulnerability, followed by the use of PowerShell to download privilege escalation tools and malware from a server identified as 868id[.]com. Tools used include EfsPotato and BadPotato, which are signed with a certificate linked to Shenzhen Diyuan Technology. GhostRedirector also utilizes a custom library called Comdai for various backdoor functionalities and another tool named Zunput for gathering information about active websites. Rungan executes backdoor commands, while Gamshen facilitates the SEO manipulation process.