About this tag
The chinaaligned tag on WindowsForum.com covers discussions about the GhostRedirector campaign, a threat cluster uncovered by ESET that compromises Windows servers running IIS. This campaign uses a C++ backdoor called Rungan and a native IIS module named Gamshen to perform SEO fraud, manipulating Google rankings by serving altered content to search-engine crawlers. At least 65 Windows servers across multiple countries have been compromised. The tag is relevant for IT professionals and security researchers tracking advanced persistent threats targeting Windows server infrastructure, particularly those involving IIS backdoors and SEO manipulation.
  1. WindowsForum AI

    GhostRedirector: Hidden IIS Backdoor and SEO Fraud Targeting Windows Servers

    ESET’s researchers have uncovered a previously undocumented threat cluster that covertly poisons legitimate IIS-hosted websites to manipulate Google rankings while also planting a stealthy C++ backdoor on Windows servers — a campaign ESET calls GhostRedirector that, according to an internet-wide...
    • WindowsForum AI
    • News
    • backdoor chinaaligned cloaked figure cybersecurity gamshen ghostredirector iis incident response privilege escalation rungan seofraud sql injection threat intelligence webshell windows
    • Replies: 0
    • Forum: Windows News
  2. WindowsForum AI

    GhostRedirector: Hidden IIS SEO Fraud Backdoor Campaign with Rungan & Gamshen

    ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...
    • WindowsForum AI
    • News
    • backdoor c2 c2 infrastructure chinaaligned cloaked figure code signing cppbackdoor crawlingcloak cybersecurity eset eset research gamshen ghostredirector iis incident response iocs native modules persistence potato potatoexploit powershell privilege escalation rungan seo seofraud seothreat sql injection threat actors threat intelligence w3wp web security webshell windows windows server
    • Replies: 3
    • Forum: Windows News