Cybersecurity researchers have lifted the lid on a beforehand undocumented menace cluster dubbed GhostRedirector that has managed to compromise a minimum of 65 Home windows servers primarily situated in Brazil, Thailand, and Vietnam.
The assaults, per Slovak cybersecurity firm ESET, led to the deployment of a passive C++ backdoor known as Rungan and a local Web Info Providers (IIS) module codenamed Gamshen. The menace actor is believed to be lively since a minimum of August 2024.
“Whereas Rungan has the potential of executing instructions on a compromised server, the aim of Gamshen is to offer website positioning fraud as-a-service, i.e., to control search engine outcomes, boosting the web page rating of a configured goal web site,” ESET researcher Fernando Tavella mentioned in a report shared with The Hacker Information.
“Although Gamshen solely modifies the response when the request comes from Googlebot – i.e., it doesn’t serve malicious content material or in any other case have an effect on common guests of the web sites – participation within the website positioning fraud scheme can damage the compromised host web site’s status by associating it with shady website positioning methods and the boosted web sites.”
Among the different targets of the hacking group embrace Peru, the U.S., Canada, Finland, India, the Netherlands, the Philippines, and Singapore. The exercise can be mentioned to be indiscriminate, with entities within the schooling, healthcare, insurance coverage, transportation, know-how, and retail sectors singled out.
Preliminary entry to focus on networks is achieved by exploiting a vulnerability, probably an SQL injection flaw, after which PowerShell is used to ship further instruments hosted on a staging server (“868id[.]com”).
“This conjecture is supported by our commentary that the majority unauthorized PowerShell executions originated from the binary sqlserver.exe, which holds a saved process xp_cmdshell that can be utilized to execute instructions on a machine,” ESET mentioned.
Rungan is designed to await incoming requests from a URL matching a predefined sample (i.e., “https://+:80/v1.0/8888/sys.html”), after which proceeds to parse and execute the instructions embedded in them. It helps 4 totally different instructions –
- mkuser, to create a consumer on the server with the username and password offered
- listfolder, to gather data from a offered path (unfinished)
- addurl, to register new URLs that the backdoor can pay attention on
- cmd, to run a command on the server utilizing pipes and the CreateProcessA API
Written in C/C++, Gamshen is an instance of an IIS malware household known as “Group 13,” which might act each as a backdoor and conduct website positioning fraud. It capabilities just like IISerpent, one other IIS-specific malware that was documented by ESET again in August 2021.
IISerpent, configured as a malicious extension for Microsoft’s internet server software program, permits it to intercept all HTTP requests made to the web sites hosted by the compromised server, particularly these originating from search engine crawlers, and alter the server’s HTTP responses with the purpose of redirecting the various search engines to a rip-off web site of the attacker’s selecting.
“GhostRedirector makes an attempt to control the Google search rating of a particular, third-party web site through the use of manipulative, shady website positioning methods corresponding to creating synthetic backlinks from the authentic, compromised web site to the goal web site,” Tavella mentioned.
It is presently not identified the place these backlinks redirect unsuspecting customers to, but it surely’s believed that the website positioning fraud scheme is getting used to advertise numerous playing web sites.
Additionally dropped alongside Rungan and Gamshen are numerous different instruments –
- GoToHTTP to determine a distant connection that is accessible from an internet browser
- BadPotato or EfsPotato for making a privileged consumer within the Directors group
- Zunput to gather details about web sites hosted on the IIS server and drop ASP, PHP, and JavaScript internet shells
It is assessed with medium confidence that GhostRedirector is a China-aligned menace actor based mostly on the presence of hard-coded Chinese language strings within the supply code, a code-signing certificates issued to a Chinese language firm, Shenzhen Diyuan Expertise Co., Ltd., to signal the privilege escalation artifacts, and using the password “huang” for one of many GhostRedirector-created customers on the compromised server.
That mentioned, GhostRedirector shouldn’t be the primary China-linked menace actor to make use of malicious IIS modules for website positioning fraud. Over the previous yr, each Cisco Talos and Pattern Micro have detailed a Chinese language-speaking group generally known as DragonRank that has engaged in website positioning manipulation by way of BadIIS malware.
“Gamshen abuses the credibility of the web sites hosted on the compromised server to advertise a third-party, playing web site – doubtlessly a paying consumer collaborating in an website positioning fraud as-a-service scheme,” the corporate mentioned.
“GhostRedirector additionally demonstrates persistence and operational resilience by deploying a number of distant entry instruments on the compromised server, on high of making rogue consumer accounts, all to take care of long-term entry to the compromised infrastructure.”
