ESET researchers have uncovered a compact but sophisticated campaign — tracked as GhostRedirector — that has secretly turned at least 65 Internet‑facing Windows servers into a stealthy SEO‑fraud network while simultaneously installing a resilient native backdoor for long‑term access. Background...
ESET researchers have uncovered a compact but sophisticated campaign — tracked as GhostRedirector — that has compromised at least 65 Internet‑facing Windows servers and combined a native C++ backdoor with a malicious IIS native module to deliver long‑lived persistence and server‑side SEO fraud...
ESET Research revealed that a previously undocumented threat actor, which the company calls GhostRedirector, compromised at least 65 Internet‑facing Windows IIS hosts and deployed two custom native components — a C++ backdoor named Rungan and a malicious IIS module called Gamshen — to run a...
ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...