GhostRedirector: Chinese SEO Poisoning Attack Hits Global IIS Web Servers (2024)

In August 2024, a cybercrime group tracked as "GhostRedirector" conducted a widespread SEO poisoning campaign targeting Windows web servers across Brazil, Vietnam, Thailand, and several other regions. The attackers exploited unpatched SQL injection vulnerabilities to gain initial access and deployed custom malware, including Rungan (a C++ backdoor) and Gamshen (a malicious IIS server extension), to maintain persistence and manipulate web content. The campaign's main tactic was to covertly inject links into compromised legitimate websites, boosting the search engine rankings of gambling sites favored by the threat actors. Affected sites span diverse sectors without clear industry targeting, complicating defense strategies.

The incident illustrates the persistent risk posed by native IIS module malware and the ongoing evolution of China-based threat actors using advanced web server exploitation and SEO manipulation tactics. Its relevance is heightened by increased attacker interest in manipulating search engine results to drive illicit business revenue and evade detection by blending with legitimate site infrastructure.

The attack exposes how adversaries weaponize web infrastructure to manipulate global SEO, impact business reputation, and subvert standard detection methods. Organizations with public web servers must act urgently to secure administrative access, patch vulnerabilities, and monitor for advanced post-compromise threats like malicious IIS extensions.