Story perspectives

China-Aligned Hackers Compromise 65+ Servers, Targeting Key Sectors

9/5/2025

Summary

Story summary

GhostRedirector, a China-aligned hacking group, has compromised over 65 Windows servers since August 2024, mainly in South America and Southeast Asia.
The group uses advanced malware, such as Rungan and Gamshen, to manipulate Google search rankings for gambling sites.
They likely gain initial access through SQL injection vulnerabilities, followed by privilege escalation and server control.
Experts stress securing public-facing servers and monitoring for unusual activity to prevent attacks.
The attacks affect various sectors, including education, healthcare, and retail, underscoring the need for improved cybersecurity.

1 of 1

Story summary

GhostRedirector, a China-aligned hacking group, has compromised over 65 Windows servers since August 2024, mainly in South America and Southeast Asia.
The group uses advanced malware, such as Rungan and Gamshen, to manipulate Google search rankings for gambling sites.
They likely gain initial access through SQL injection vulnerabilities, followed by privilege escalation and server control.
Experts stress securing public-facing servers and monitoring for unusual activity to prevent attacks.
The attacks affect various sectors, including education, healthcare, and retail, underscoring the need for improved cybersecurity.