Overview
GhostRedirector is a threat group that compromises Windows servers using a C++ backdoor called Rungan and a malicious IIS module known as Gamshen. While Rungan allows remote command execution, Gamshen manipulates search engine results for SEO fraud, harming the reputation of affected servers. Attackers gain entry through vulnerabilities like SQL injection and then deploy additional tools via PowerShell. This highlights the growing use of IIS modules for persistence, covert operations, and fraudulent activities.
Technical Details
- Access Vector: Attackers exploit SQL injection flaws to gain initial foothold, often via vulnerable applications.
- Tool Deployment: Malicious payloads (Rungan backdoor, Gamshen IIS module) delivered using PowerShell from staging servers like 868id[.]com.
- Privilege Escalation & Persistence: Creates rogue admin accounts…..
