GhostRedirector
GhostRedirector is a China-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 6 sectors, including Technology and Finance, in 4 countries, including the United States and Brazil. It uses 4 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 4
- Exploited CVEs
- No CVE data
- First seen
- Aug 1, 2024
- Last seen
- Sep 4, 2025
- Record updated
Who They Target.
Sectors · 6
Countries · 4
Labelsbd:governance:curation:analyst-reviewed
About GhostRedirector.
Privilege escalation relies on public Potato-class exploits (EfsPotato, BadPotato) and custom helpers, plus rogue admin users for persistence. Primary motivation is financial SEO fraud rather than confirmed espionage, so type is modeled as cybercrime-syndicate rather than nation-state APT.
Last updated Aug 6, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.