Cybersecurity researchers have lifted the lid on a beforehand undocumented risk cluster dubbed GhostRedirector that has managed to compromise at the very least 65 Home windows servers primarily positioned in Brazil, Thailand, and Vietnam.
The assaults, per Slovak cybersecurity firm ESET, led to the deployment of a passive C++ backdoor referred to as Rungan and a local Web Data Providers (IIS) module codenamed Gamshen. The risk actor is believed to be lively since at the very least August 2024.
“Whereas Rungan has the potential of executing instructions on a compromised server, the aim of Gamshen is to supply search engine marketing fraud as-a-service, i.e., to govern search engine outcomes, boosting the web page rating of a configured goal web site,” ESET researcher Fernando Tavella stated in a report shared with The Hacker Information.
“Regardless that Gamshen solely modifies the response when the request comes from Googlebot – i.e., it doesn’t serve malicious content material or in any other case have an effect on common guests of the web sites – participation within the search engine marketing fraud scheme can damage the compromised host web site’s popularity by associating it with shady search engine marketing strategies and the boosted web sites.”
Among the different targets of the hacking group embody Peru, the U.S., Canada, Finland, India, the Netherlands, the Philippines, and Singapore. The exercise can be stated to be indiscriminate, with entities within the schooling, healthcare, insurance coverage, transportation, know-how, and retail sectors singled out.
Preliminary entry to focus on networks is completed by exploiting a vulnerability, possible an SQL injection flaw, after which PowerShell is used to ship further instruments hosted on a staging server (“868id[.]com”).
“This conjecture is supported by our remark that the majority unauthorized PowerShell executions originated from the binary sqlserver.exe, which holds a saved process xp_cmdshell that can be utilized to execute instructions on a machine,” ESET stated.
Rungan is designed to await incoming requests from a URL matching a predefined sample (i.e., “https://+:80/v1.0/8888/sys.html”), after which proceeds to parse and execute the instructions embedded in them. It helps 4 completely different instructions –
- mkuser, to create a person on the server with the username and password offered
- listfolder, to gather info from a offered path (unfinished)
- addurl, to register new URLs that the backdoor can hear on
- cmd, to run a command on the server utilizing pipes and the CreateProcessA API
Written in C/C++, Gamshen is an instance of an IIS malware household referred to as “Group 13,” which might act each as a backdoor and conduct search engine marketing fraud. It capabilities just like IISerpent, one other IIS-specific malware that was documented by ESET again in August 2021.
IISerpent, configured as a malicious extension for Microsoft’s net server software program, permits it to intercept all HTTP requests made to the web sites hosted by the compromised server, particularly these originating from search engine crawlers, and alter the server’s HTTP responses with the aim of redirecting the major search engines to a rip-off web site of the attacker’s selecting.
“GhostRedirector makes an attempt to govern the Google search rating of a particular, third-party web site by utilizing manipulative, shady search engine marketing strategies resembling creating synthetic backlinks from the reputable, compromised web site to the goal web site,” Tavella stated.
It is at the moment not recognized the place these backlinks redirect unsuspecting customers to, nevertheless it’s believed that the search engine marketing fraud scheme is getting used to advertise numerous playing web sites.
Additionally dropped alongside Rungan and Gamshen are numerous different instruments –
- GoToHTTP to ascertain a distant connection that is accessible from an internet browser
- BadPotato or EfsPotato for making a privileged person within the Directors group
- Zunput to gather details about web sites hosted on the IIS server and drop ASP, PHP, and JavaScript net shells
It is assessed with medium confidence that GhostRedirector is a China-aligned risk actor primarily based on the presence of hard-coded Chinese language strings within the supply code, a code-signing certificates issued to a Chinese language firm, Shenzhen Diyuan Know-how Co., Ltd., to signal the privilege escalation artifacts, and using the password “huang” for one of many GhostRedirector-created customers on the compromised server.
That stated, GhostRedirector shouldn’t be the primary China-linked risk actor to make use of malicious IIS modules for search engine marketing fraud. Over the previous yr, each Cisco Talos and Pattern Micro have detailed a Chinese language-speaking group generally known as DragonRank that has engaged in search engine marketing manipulation through BadIIS malware.
“Gamshen abuses the credibility of the web sites hosted on the compromised server to advertise a third-party, playing web site – doubtlessly a paying consumer taking part in an search engine marketing fraud as-a-service scheme,” the corporate stated.
“GhostRedirector additionally demonstrates persistence and operational resilience by deploying a number of distant entry instruments on the compromised server, on high of making rogue person accounts, all to keep up long-term entry to the compromised infrastructure.”
