Cybersecurity researchers have lifted the lid on a beforehand undocumented menace cluster dubbed GhostRedirector that has managed to compromise at the least 65 Home windows servers primarily situated in Brazil, Thailand, and Vietnam.
The assaults, per Slovak cybersecurity firm ESET, led to the deployment of a passive C++ backdoor referred to as Rungan and a local Web Info Providers (IIS) module codenamed Gamshen. The menace actor is believed to be energetic since at the least August 2024.
“Whereas Rungan has the potential of executing instructions on a compromised server, the aim of Gamshen is to offer search engine optimization fraud as-a-service, i.e., to govern search engine outcomes, boosting the web page rating of a configured goal web site,” ESET researcher Fernando Tavella stated in a report shared with The Hacker Information.
“Although Gamshen solely modifies the response when the request comes from Googlebot – i.e., it doesn’t serve malicious content material or in any other case have an effect on common guests of the web sites – participation within the search engine optimization fraud scheme can damage the compromised host web site’s fame by associating it with shady search engine optimization methods and the boosted web sites.”
Among the different targets of the hacking group embody Peru, the U.S., Canada, Finland, India, the Netherlands, the Philippines, and Singapore. The exercise can also be stated to be indiscriminate, with entities within the training, healthcare, insurance coverage, transportation, expertise, and retail sectors singled out.
Preliminary entry to focus on networks is achieved by exploiting a vulnerability, doubtless an SQL injection flaw, after which PowerShell is used to ship further instruments hosted on a staging server (“868id[.]com”).
“This conjecture is supported by our commentary that the majority unauthorized PowerShell executions originated from the binary sqlserver.exe, which holds a saved process xp_cmdshell that can be utilized to execute instructions on a machine,” ESET stated.
Rungan is designed to await incoming requests from a URL matching a predefined sample (i.e., ” after which proceeds to parse and execute the instructions embedded in them. It helps 4 completely different instructions –
mkuser, to create a consumer on the server with the username and password supplied
listfolder, to gather data from a supplied path (unfinished)
addurl, to register new URLs that the backdoor can pay attention on
cmd, to run a command on the server utilizing pipes and the CreateProcessA API
Written in C/C++, Gamshen is an instance of an IIS malware household referred to as “Group 13,” which may act each as a backdoor and conduct search engine optimization fraud. It capabilities much like IISerpent, one other IIS-specific malware that was documented by ESET again in August 2021.
IISerpent, configured as a malicious extension for Microsoft’s internet server software program, permits it to intercept all HTTP requests made to the web sites hosted by the compromised server, particularly these originating from search engine crawlers, and alter the server’s HTTP responses with the objective of redirecting the major search engines to a rip-off web site of the attacker’s selecting.
“GhostRedirector makes an attempt to govern the Google search rating of a selected, third-party web site through the use of manipulative, shady search engine optimization methods comparable to creating synthetic backlinks from the authentic, compromised web site to the goal web site,” Tavella stated.
It is at present not recognized the place these backlinks redirect unsuspecting customers to, however it’s believed that the search engine optimization fraud scheme is getting used to advertise numerous playing web sites.
Additionally dropped alongside Rungan and Gamshen are numerous different instruments –
GoToHTTP to determine a distant connection that is accessible from an internet browser
BadPotato or EfsPotato for making a privileged consumer within the Directors group
Zunput to gather details about web sites hosted on the IIS server and drop ASP, PHP, and JavaScript internet shells
It is assessed with medium confidence that GhostRedirector is a China-aligned menace actor based mostly on the presence of hard-coded Chinese language strings within the supply code, a code-signing certificates issued to a Chinese language firm, Shenzhen Diyuan Know-how Co., Ltd., to signal the privilege escalation artifacts, and using the password “huang” for one of many GhostRedirector-created customers on the compromised server.
That stated, GhostRedirector isn’t the primary China-linked menace actor to make use of malicious IIS modules for search engine optimization fraud. Over the previous yr, each Cisco Talos and Pattern Micro have detailed a Chinese language-speaking group often called DragonRank that has engaged in search engine optimization manipulation through BadIIS malware.
“Gamshen abuses the credibility of the web sites hosted on the compromised server to advertise a third-party, playing web site – probably a paying shopper collaborating in an search engine optimization fraud as-a-service scheme,” the corporate stated.
“GhostRedirector additionally demonstrates persistence and operational resilience by deploying a number of distant entry instruments on the compromised server, on prime of making rogue consumer accounts, all to take care of long-term entry to the compromised infrastructure.”
