'SEO fraud-as-a-service' scheme hijacks Windows servers to promote gambling websites

ESET researchers identified GhostRedirector, a likely China-aligned actor active since at least August 2024 that has breached at least 65 Windows servers across multiple countries and industries. The group deployed two novel backdoors—Rungan for remote command execution and Gamshen embedded in IIS to covertly boost gambling sites' Google rankings—using public exploits and privileged accounts; the immediate impact is SEO fraud and reputational harm, though the Rungan backdoor could enable additional malicious activity.