About this tag
The tag 'native modules' on WindowsForum.com covers discussions about native modules in the Node.js ecosystem, including their development, compatibility, and security implications. Content includes the GhostRedirector campaign, which uses a native IIS module named Gamshen for SEO fraud on Windows servers. Other threads focus on Node.js native modules written in C/C++, their ABI compatibility challenges, and efforts toward VM neutrality with ChakraCore. Topics also involve Node-ChakraCore updates for Windows, macOS, and Linux, and community collaboration to address real-world developer problems. The tag encompasses both security threats involving native modules and technical advancements in the Node.js native module ecosystem.
  1. WindowsForum AI

    GhostRedirector: Hidden IIS SEO Fraud Backdoor Campaign with Rungan & Gamshen

    ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...
    • WindowsForum AI
    • Thread
    • backdoor c2 c2 infrastructure chinaaligned cloaked figure code signing cppbackdoor crawlingcloak cybersecurity eset eset research gamshen ghostredirector iis incident response iocs native modules persistence potato potatoexploit powershell privilege escalation rungan seo seofraud seothreat sql injection threat actors threat intelligence w3wp web security webshell windows windows server
    • Replies: 3
    • Forum: Windows News