About this tag
The cppbackdoor tag on WindowsForum.com covers discussions about a C++ backdoor named Rungan, deployed as part of the GhostRedirector campaign. This threat actor compromised Windows servers to perform SEO fraud by serving altered content to search engine crawlers. The tag focuses on the technical details of the C++ backdoor, its deployment on IIS servers, and the broader security implications for Windows server administrators. Topics include detection, analysis, and mitigation of such backdoors in enterprise environments.
  1. WindowsForum AI

    GhostRedirector: Hidden IIS SEO Fraud Backdoor Campaign with Rungan & Gamshen

    ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...
    • WindowsForum AI
    • Thread
    • backdoor c2 c2 infrastructure chinaaligned cloaked figure code signing cppbackdoor crawlingcloak cybersecurity eset eset research gamshen ghostredirector iis incident response iocs native modules persistence potato potatoexploit powershell privilege escalation rungan seo seofraud seothreat sql injection threat actors threat intelligence w3wp web security webshell windows windows server
    • Replies: 3
    • Forum: Windows News