GhostRedirector Hacks 65 Home windows Servers Utilizing Rungan Backdoor and Gamshen IIS Module

Cybersecurity researchers have lifted the lid on a beforehand undocumented risk cluster dubbed GhostRedirector that has managed to compromise at the least 65 Home windows servers primarily situated in Brazil, Thailand, and Vietnam.

The assaults, per Slovak cybersecurity firm ESET, led to the deployment of a passive C++ backdoor referred to as Rungan and a local Web Info Providers (IIS) module codenamed Gamshen. The risk actor is believed to be energetic since at the least August 2024.

“Whereas Rungan has the potential of executing instructions on a compromised server, the aim of Gamshen is to offer website positioning fraud as-a-service, i.e., to control search engine outcomes, boosting the web page rating of a configured goal web site,” ESET researcher Fernando Tavella stated in a report shared with The Hacker Information.

“Though Gamshen solely modifies the response when the request comes from Googlebot – i.e., it doesn’t serve malicious content material or in any other case have an effect on common guests of the web sites – participation within the website positioning fraud scheme can harm the compromised host web site’s fame by associating it with shady website positioning methods and the boosted web sites.”

A few of the different targets of the hacking group embody Peru, the U.S., Canada, Finland, India, the Netherlands, the Philippines, and Singapore. The exercise can be stated to be indiscriminate, with entities within the training, healthcare, insurance coverage, transportation, expertise, and retail sectors singled out.

Preliminary entry to focus on networks is completed by exploiting a vulnerability, probably an SQL injection flaw, after which PowerShell is used to ship further instruments hosted on a staging server (“868id[.]com”).

“This conjecture is supported by our commentary that the majority unauthorized PowerShell executions originated from the binary sqlserver.exe, which holds a saved process xp_cmdshell that can be utilized to execute instructions on a machine,” ESET stated.

Rungan is designed to await incoming requests from a URL matching a predefined sample (i.e., “https://+:80/v1.0/8888/sys.html”), after which proceeds to parse and execute the instructions embedded in them. It helps 4 totally different instructions –

• mkuser, to create a person on the server with the username and password offered
• listfolder, to gather data from a offered path (unfinished)
• addurl, to register new URLs that the backdoor can hear on
• cmd, to run a command on the server utilizing pipes and the CreateProcessA API

Written in C/C++, Gamshen is an instance of an IIS malware household referred to as “Group 13,” which might act each as a backdoor and conduct website positioning fraud. It features much like IISerpent, one other IIS-specific malware that was documented by ESET again in August 2021.

IISerpent, configured as a malicious extension for Microsoft’s internet server software program, permits it to intercept all HTTP requests made to the web sites hosted by the compromised server, particularly these originating from search engine crawlers, and alter the server’s HTTP responses with the purpose of redirecting the various search engines to a rip-off web site of the attacker’s selecting.

“GhostRedirector makes an attempt to control the Google search rating of a selected, third-party web site by utilizing manipulative, shady website positioning methods similar to creating synthetic backlinks from the legit, compromised web site to the goal web site,” Tavella stated.

It is at present not identified the place these backlinks redirect unsuspecting customers to, however it’s believed that the website positioning fraud scheme is getting used to advertise varied playing web sites.

Additionally dropped alongside Rungan and Gamshen are varied different instruments –

• GoToHTTP to determine a distant connection that is accessible from an online browser
• BadPotato or EfsPotato for making a privileged person within the Directors group
• Zunput to gather details about web sites hosted on the IIS server and drop ASP, PHP, and JavaScript internet shells

It is assessed with medium confidence that GhostRedirector is a China-aligned risk actor primarily based on the presence of hard-coded Chinese language strings within the supply code, a code-signing certificates issued to a Chinese language firm, Shenzhen Diyuan Know-how Co., Ltd., to signal the privilege escalation artifacts, and using the password “huang” for one of many GhostRedirector-created customers on the compromised server.

That stated, GhostRedirector just isn’t the primary China-linked risk actor to make use of malicious IIS modules for website positioning fraud. Over the previous 12 months, each Cisco Talos and Development Micro have detailed a Chinese language-speaking group often known as DragonRank that has engaged in website positioning manipulation through BadIIS malware.

“Gamshen abuses the credibility of the web sites hosted on the compromised server to advertise a third-party, playing web site – probably a paying consumer taking part in an website positioning fraud as-a-service scheme,” the corporate stated.

“GhostRedirector additionally demonstrates persistence and operational resilience by deploying a number of distant entry instruments on the compromised server, on high of making rogue person accounts, all to keep up long-term entry to the compromised infrastructure.”