Over 65 compromised Windows servers identified as of June 2025, with victims in multiple countries. The attacks affected companies in the insurance, healthcare, retail, transportation, technology and education sectors. The group used custom tools, including the Rungan backdoor and the Gamshen IIS module for SEO fraud
Researchers of ESET, a global European leader in the cybersecurity market, have discovered a new threat actor, which they have named GhostRedirector. As of June 2025, this group compromised at least 65 Windows servers, primarily located in Brazil, Thailand, Vietnam, and the United States. Other victims were identified in Canada, Finland, India, the Netherlands, the Philippines and Singapore.
GhostRedirector used two custom and so far undocumented tools: a passive backdoor in C++, which ESET called Rungan, and a malicious Internet Information Services (IIS) module, called Gamshen. GhostRedirector is reasonably certain to be a threat actor linked to China. While Rungan allows attackers to execute commands on the compromised server, Gamshen is instead designed to carry out SEO fraud in as-a-service mode: it manipulates Google search results to artificially improve the ranking of certain websites, with the aim of promoting especially online betting portals.
“Although Gamshen only modifies the response when the request comes from Googlebot — meaning it does not serve malicious content or affect the navigation of regular visitors — participation in this SEO fraud scheme can damage the reputation of the compromised site by associating it with poor SEO practices and the sites that benefit from it,” explained Fernando Tavella, the ESET researcher who made the discovery.
In addition to Rungan and Gamshen, GhostRedirector also employs other custom tools, in addition to well-known exploits such as EfsPotato and BadPotato. These are used to create an elevated account on the compromised server. The account allows attackers to download and execute additional malicious components with administrative rights and, at the same time, represents an alternative entry route in case Rungan or other tools are removed from the system.
While the victims are spread across multiple geographic regions, the majority of compromised servers located in the United States appear to have been rented by companies based in Brazil, Thailand, and Vietnam, the same countries where the majority of the victims are located. For this reason, ESET Research believes that GhostRedirector's interest was primarily aimed at targets in Latin America and Southeast Asia. GhostRedirector showed no preference towards a specific vertical sector; ESET has in fact identified victims in multiple sectors, including education, healthcare, insurance, transportation, technology and retail.
According to ESET telemetry, GhostRedirector likely gains initial access to victims by exploiting a vulnerability, most likely SQL Injection. After compromising a Windows server, attackers download and execute various malicious tools: a privilege escalation tool, malware that installs multiple webshells, or the aforementioned IIS backdoors and Trojans. In addition to the obvious purpose of increasing privileges, these tools can also be used as backup access in case the group loses control of the server. The backdoor's capabilities include network communications, file execution, directory browsing, and manipulation of Services and Windows registry keys.
“GhostRedirector also demonstrates operational persistence and resilience by deploying multiple remote access tools on compromised servers and creating fake user accounts in an effort to maintain long-term access to breached infrastructure,” Tavella added.
ESET telemetry detected GhostRedirector-related attacks between December 2024 and April 2025, and a large-scale internet scan conducted in June 2025 identified additional victims. ESET has informed all victims identified through the scan of the compromise. Mitigation recommendations are described in a white paper already available.
For a more in-depth analysis and technical description of GhostRedirector, the latest ESET Research article is available on the WeLiveSecurity.com blog, “GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes”. ESET Research updates can also be followed on Twitter (today X), BlueSky e Mastodon.
