GhostRedirector
- Origin
- CN
- Primary motivation
- financial-gain
- Sophistication
- expert
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:23:08
Targeted industries: technology-and-telecommunications government-and-public-sector financial-services
Targeted regions: country_code:br country_code:th country_code:vn
Context
GhostRedirector is a China-aligned threat actor that has compromised at least 65 Windows servers across various sectors, primarily in Brazil, Thailand, and Vietnam. It employs a passive C++ backdoor named Rungan and a malicious IIS module called Gamshen to maintain persistent access and manipulate search engine results for SEO fraud. The actor utilizes public exploits like EfsPotato and BadPotato for privilege escalation and abuses code-signing certificates to evade detection. GhostRedirector's operations involve installing remote access tools, creating rogue administrator accounts, and leveraging SQL injection vulnerabilities to execute PowerShell for downloading malicious payloads.
Reports & references
- ESET — Ghostredirector Poisons Windows Servers Backdoors Side Potatoes (report)