The Chinese Cybercrime Group has manipulated SEO to stimulate game websites
ESET researchers discovered a group of professional Chinese cybercriminals that handle referencing to increase traffic to game websites.
Nicknamed Ghostredirector by the ESET cybersecurity software company, the bad actor would have compromised at least 65 Windows servers located mainly in Brazil, Thailand and Vietnam. The researchers say that the group uses two tailor -made tools: a passive C ++ stolen door that they have nicknamed Rungan, and a malicious Internet Information Services module they have appointed Gamshen.
Rungan can run orders on a compromised server, while Gamshen can perform SEO fraud to manipulate the search engine results. This can stimulate the classification of the pages of a website, which is used by the crime group to increase traffic to game game websites.
Although it can only modify Googlebot’s responses, so will not affect regular website visitors, using such a tool can damage the reputation of long -term host’s websites.
Researchers have found a series of other personalized tools used by Ghostredirector, as well as familiar names in the world of cybercrime, such as Efspotato and Badpotato. It is believed that these are used as backups if Rungan had to fail, or attack servers with higher security privileges.
“We believe with an average confidence that an actor of threat aligned by China was at the origin of these attacks,” reads ESET’s declaration.
How to protect yourself from cybercrime tools
To protect against these tools, ESET recommends ensuring that organizations use dedicated accounts, strong passwords and multifactorial authentication as far as possible. These steps are particularly important for server administrators IIS.
Indeed, Ghostredirector and other cybercriminals can only deploy personalized IIS tools on servers already compromised. Prevent them from accessing them in the first place protects against personalized malware like Rungan and, by extension, Gamshen.
ESET also advises that administrators should ensure that the native IIS modules can only be installed from sources of trust and are signed by a trust supplier, ideally requiring two parts for a successful installation.
Star image: aplash
The Post Pro Cybercrime Group manipulates SEO to stimulate games websites appeared first on Readwrite.
[og_img]
About The Author
