seo fraud

  1. GhostRedirector: New IIS Module and Rungan Backdoor Drive SEO Fraud on Windows

    ESET Research revealed that a previously undocumented threat actor, which the company calls GhostRedirector, compromised at least 65 Internet‑facing Windows IIS hosts and deployed two custom native components — a C++ backdoor named Rungan and a malicious IIS module called Gamshen — to run a...
  2. GhostRedirector: Hidden IIS SEO Fraud Backdoor Campaign with Rungan & Gamshen

    ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...