GhostRedirector: Hidden IIS Backdoor and SEO Fraud on Windows Servers

ESET researchers have uncovered a compact but sophisticated campaign — tracked as GhostRedirector — that has secretly turned at least 65 Internet‑facing Windows servers into a stealthy SEO‑fraud network while simultaneously installing a resilient native backdoor for long‑term access. (eset.com) (thehackernews.com)

Background / Overview​

GhostRedirector was publicly disclosed by ESET Research after telemetry and targeted scanning revealed intrusions on IIS‑hosted Windows servers observed between December 2024 and April 2025, with a June 2025 internet‑wide scan raising the confirmed count to at least 65 infected hosts across multiple countries. The affected servers are concentrated in Brazil, Thailand and Vietnam, with additional victims in the United States, Canada, Finland, India, the Netherlands, the Philippines and Singapore. (eset.com) (therecord.media)
The campaign pairs two custom native artifacts: Rungan, a passive C++ backdoor that enables command execution and persistence on the host, and Gamshen, a malicious native Internet Information Services (IIS) module that performs crawler‑aware cloaking and SEO fraud — i.e., it alters HTTP responses only for search engine crawlers to boost third‑party websites (observed beneficiaries include gambling domains). These complementary tools create a low‑noise monetization model that preserves normal user experience while hijacking domain reputation for paid ranking boosts. (eset.com) (thehackernews.com)
ESET associates the cluster with a China‑aligned actor with medium to high confidence, based on code artifacts, embedded language strings and a code‑signing certificate linked to a Shenzhen company; however, attribution remains an analytic judgment and is explicitly probabilistic. Readers and responders should treat geopolitical conclusions as a working hypothesis rather than definitive proof. (eset.com)

---

Why this matters: SEO fraud meets server backdoors​

Most web server compromises are used for data theft, hosting phishing pages, or running commodity abuse such as cryptomining. GhostRedirector is notable because it weaponizes search‑engine trust rather than directly stealing visible site content. By serving specialized content only to crawlers, attackers can:

• Borrow a compromised domain’s authority to create backlinks and doorway pages that artificially boost target websites in search results.
• Keep the site’s outward appearance unchanged for everyday visitors, greatly delaying discovery.
• Monetize the infrastructure through an “SEO fraud‑as‑a‑service” model that is inherently low‑risk and highly scalable. (thehackernews.com)

At the same time, the presence of a native backdoor (Rungan) and redundant persistence mechanisms (webshells, rogue user accounts, signed binaries and Potato‑family escalation tools) raises the operational cost for defenders. Partial cleanups often fail; full rebuilds are frequently required to guarantee eradication.

---

Anatomy of the attack​

Initial access and staging​

ESET’s analysis points to a common pattern: the likely initial vector is a web application vulnerability — most commonly SQL injection — on internet‑facing IIS hosts. Attackers exploit the web layer to execute OS commands (via xp_cmdshell or similar) and stage a small downloader that retrieves additional modules and tools from attacker infrastructure. (eset.com)
Once foothold is established, operators deploy a toolkit that includes:

• Privilege‑escalation utilities from the “Potato” family (EfsPotato, BadPotato) to obtain SYSTEM or elevated privileges.
• Webshells (ASP, PHP, JavaScript) and downloaders to ensure persistent access.
• The native backdoor Rungan and the IIS module Gamshen for crawler‑aware manipulation. (thehackernews.com)

Rungan: passive C++ backdoor​

Rungan is a compiled, native C++ implant designed for minimal noise and flexible command execution. Key observed capabilities include:

• Registering listener endpoints and parsing commands delivered via specific URL patterns.
• Executing OS commands (CreateProcessA) and returning output.
• Creating local user accounts (mkuser), enumerating file system directories (listfolder) and registering new URLs for backdoor callbacks (addurl). (thehackernews.com)

Because Rungan is native code and can run either as a standalone binary or within privileged processes, it is resilient against simple file‑integrity checks and can hide in legitimate ProgramData or system folders. Detection therefore requires memory and process inspection in addition to filesystem hunts.

Gamshen: malicious IIS module that cloaks for crawlers​

Gamshen is an IIS native module — a DLL loaded into w3wp.exe — that inspects incoming requests and selectively modifies HTTP responses when the user‑agent or request origin matches search‑engine crawlers (for example, Googlebot). In practice the module:

• Injects backlinks, redirects, or specialized content only for crawler requests.
• Leaves normal visitor traffic unaffected, evading ordinary QA and manual review.
• Converts affected websites into invisible “doorway” pages that pass ranking signals to attacker‑controlled targets (primarily gambling sites in observed samples). (eset.com)

IIS native modules run in‑process and inherit the privileges of the worker process, giving attackers powerful and persistent control over request/response behavior. This makes Gamshen particularly stealthy and damaging from a reputation standpoint.

---

Evidence, reliability, and attribution caveats​

ESET’s disclosure is the primary public source for technical detail and telemetry. Independent reporting from multiple cybersecurity outlets and aggregators corroborates the core findings — compromised IIS hosts, Rungan and Gamshen artifacts, and likely SQLi initial access — giving reasonable confidence in the technical claims. (eset.com, thehackernews.com)
That said, several items remain unverifiable from public data alone:

• The full scope of victims: the reported figure of “at least 65” is a conservative minimum based on visible telemetry and an internet scan; the actual number may be materially larger.
• The comprehensive list of beneficiary domains and affiliate clients that received ranking boosts: observed samples point to gambling sites, but the complete client list and revenue flows are not publicly disclosed.
• Attribution beyond “very likely China‑aligned”: language strings, PDB paths, and a code‑signing certificate point to regional linkage, but these signals are probabilistic and can be manipulated. Treat geopolitical attribution as an informed hypothesis, not a proven fact. (eset.com)

---

Detection: where defenders should look first​

The nature of Gamshen’s crawler‑aware behavior creates detection blind spots for conventional audits. Defenders should prioritize the following hunts and telemetry sources:

• Compare crawler vs. real‑user responses. Issue parallel requests using a Googlebot user‑agent and a standard browser user‑agent from trusted IPs; flag any content differences, redirects, or backlink injections. This is the fastest way to reveal crawler‑only cloaking.
• Enumerate IIS native modules and configuration. Use appcmd list modules and inspect applicationHost.config for unexpected module entries, suspicious DLL names (examples observed include ManagedEngine64_v2.dll / ManagedEngine32_v2.dll), and unusual paths.
• Hunt for known artifact names and file locations. Examples seen in the campaign: miniscreen.dll (Rungan), ManagedEngine*_v2.dll (Gamshen), link.exe (GoToHTTP helper), and binaries under ProgramData or inetsrv directories.
• Monitor Sysmon/EDR for Potato‑style privilege escalation and token abuse. Rules should capture CreateProcessWithToken, CreateProcessAsUser, named pipe creation, and other token‑impersonation behaviors associated with local escalation.
• Check for rogue local user accounts and anomalous service DLL registrations. Attackers often create accounts with weak or embedded passwords and register malicious ServiceDLL values in the registry to regain persistence.

---

Immediate mitigation checklist​

• Isolate suspected hosts from production networks and preserve forensic artifacts (memory snapshots, event logs, applicationHost.config, w3wp memory).
• If Gamshen or Rungan artifacts are confirmed, assume multi‑vector persistence is present and plan for a full rebuild from known‑good images rather than an in‑place removal. Partial removals are frequently unsuccessful.
• Rotate credentials, revoke or validate any code‑signing certificates used to sign anomalous binaries, and review recently issued certificates.
• Harden web applications: patch and remediate SQL injection and code‑injection vectors; disable xp_cmdshell and limit the SQL Server service’s OS privileges.
• Tune or deploy a WAF with SQLi protections and validate false‑positive rates against legitimate traffic patterns.

Operationally, the single highest‑impact action is to “test as the crawler” and hunt for differences. If crawler‑only manipulations are present, coordinate remediation with SEO specialists and plan to submit search‑engine reconsideration requests after cleanup.

---

Technical strengths of the adversary — and why they succeed​

• In‑process persistence: Native IIS modules run within the IIS worker process and can manipulate traffic invisibly; this dramatically reduces the likelihood of discovery through standard file‑based scans. (eset.com)
• Layered fallbacks: The use of webshells, rogue accounts, signed binaries and Potato LPE exploits creates a redundancy that survives single‑component removal attempts.
• Low‑noise monetization: SEO fraud produces revenue without generating the noisy network patterns or user‑visible changes that trigger rapid incident response, enabling attackers to operate long‑term.

These operational advantages explain why a compact actor can extract outsized value: a single compromised IIS estate can serve as a persistent, monetizable asset for ranking boosts.

---

Business, legal and SEO implications​

Compromised domains used for SEO fraud face consequences beyond simple technical remediation:

• Search penalties and domain de‑ranking: Google and other search engines actively penalize cloaking and manipulative backlink schemes; a domain found participating in such schemes can suffer long‑term traffic declines.
• Brand reputation damage: Even if everyday users do not see injected content, the presence of cloaking and malicious backlinks can damage trust and cause downstream partners to reassess relationships.
• Regulatory exposure: If compromised hosts process regulated data (healthcare, education, insurance), the incident may trigger reporting obligations and legal risk.

Mitigation therefore requires cross‑functional coordination: technical teams must work with legal, compliance, hosting providers and SEO vendors to validate cleanup and request reconsideration from search platforms where appropriate.

---

What defenders should watch for next​

• Expansion of scope: the reported 65 hosts are likely conservative; campaigns of this type can scale quickly if initial access vectors remain common.
• Monetization broadening: Gamshen‑style modules could be repurposed for other high‑value verticals or offered as a paid “SEO‑as‑a‑service” to third parties.
• Tooling evolution: Rungan variants with lateral movement or additional stealth capabilities could appear, and other criminal groups may reuse the module pattern.

---

Practical, long‑term hardening guidance​

• Treat internet‑facing IIS servers as high‑risk critical assets and apply hardened controls and monitoring similar to domain controllers or VPN concentrators.
• Enforce least privilege for service accounts, require MFA and just‑in‑time elevation for administrative actions that can register modules or modify applicationHost.config.
• Implement robust telemetry: deploy EDR with module‑load detection, enable Sysmon with named‑pipe and token event logging, and centralize web logs for crawler‑aware comparison.
• Regularly audit and inventory IIS modules and code‑signing certificates, and block unsigned or unexpected native extensions where possible.
• Include SEO integrity as part of incident response: monitor Search Console and backlink profiles for anomalies and make the appropriate cross‑team notifications when suspicious crawler behavior is detected.

---

Final assessment: strengths, risks, and takeaway actions​

GhostRedirector illustrates an operationally mature model that combines stealthy, in‑process manipulation with traditional persistence and escalation techniques. Its core strengths — low noise, in‑process cloaking and layered redundancy — make it a powerful threat to reputation and search visibility even when direct user‑facing impacts are minimal. (eset.com)
Primary risks for organizations are reputational harm, costly remediation (often requiring full rebuilds), regulatory exposure when sensitive data is involved, and the strategic risk of becoming an unwitting infrastructure partner in criminal SEO schemes.
Immediate priorities for Windows and IIS administrators:

• Hunt now: run crawler vs. user‑agent response comparisons and inventory IIS modules.
• Assume layered persistence and prepare for full rebuilds if GhostRedirector artifacts are found.
• Harden web applications against SQL injection and apply WAF protections as a near‑term barrier.

ESET’s disclosure provides a technical starting point; organizations should combine vendor guidance with local telemetry to scope impact, eliminate persistence, and restore trust with search platforms and customers. Attribution should guide strategic response but not distract from the immediate operational tasks of detection, containment and remediation. (eset.com)

---

GhostRedirector demonstrates a clear lesson for modern defenders: infrastructure reputation is now a tangible attack surface. Protecting web servers means not only guarding data and uptime, but also the invisible signals given to search engines — signals that attackers can quietly hijack to monetize compromised estates without ever triggering obvious alarms. Immediate, crawler‑aware hunts and robust behavioral telemetry are the most reliable defenses against this quietly damaging class of abuse. (thehackernews.com)

---

Source: HotHardware Ghastly GhostRedirector Gang Is Hijacking Windows Servers For Google SEO Tricks