Hackers Manipulate Search Results to Target IT Pros with Trojanized PuTTY and WinSCP

Arctic Wolf has uncovered a cunning cybersecurity threat that exploits search engine optimization (SEO) poisoning and malvertising tactics to distribute Trojanized versions of widely used IT tools such as PuTTY and WinSCP.

This campaign cunningly targets IT professionals and system administrators, individuals who frequently rely on these tools for secure file transfers and remote system management.

Malvertising Campaign Unveiled

By manipulating search engine results and placing malicious sponsored ads on platforms like Bing, threat actors have created a deceptive web of fake websites that mimic legitimate sources.

Unsuspecting users who download from these fraudulent sites inadvertently install malware, posing a significant risk to both individual systems and organizational security.

The mechanics of this attack are both sophisticated and stealthy. The malicious websites host Trojanized installers of PuTTY and WinSCP, which, upon execution, deploy a backdoor identified as Oyster or Broomstick.

These backdoor grants attackers unauthorized access to the compromised system, potentially leading to data theft, lateral movement within networks, or further malware deployment.

Technical Breakdown of the Persistence Mechanism

To ensure persistence, the malware creates a scheduled task that executes every three minutes, leveraging a malicious DLL file named twain_96.dll.

This DLL is executed via rundll32.exe using the DllRegisterServer export, a technique that abuses the DLL registration process to maintain a foothold on the infected system.

While only PuTTY and WinSCP have been confirmed as targets in this campaign, Arctic Wolf warns that other IT tools could also be weaponized in similar attacks, urging heightened vigilance across the board.

The implications of this campaign are far-reaching, especially for IT environments where trust in tools like PuTTY and WinSCP is paramount.

A single infected system could serve as an entry point for broader network compromise, making it imperative for organizations to act swiftly.

Arctic Wolf strongly recommends that IT teams and users avoid relying on search engines to download administrative tools. Instead, software should be sourced exclusively from vetted internal repositories or directly from official vendor websites.

This practice significantly reduces the risk of falling victim to SEO poisoning and malicious ads that lead to Trojanized downloads.

Furthermore, organizations are advised to educate their staff, particularly IT personnel, about the dangers of unverified download sources and to implement strict policies governing software acquisition.

As a proactive defense measure, Arctic Wolf has identified several domains linked to this malicious activity that should be blocked immediately to prevent access to harmful download sources.

By integrating these indicators of compromise (IOCs) into security controls such as firewalls and endpoint protection systems, organizations can minimize their exposure to this ongoing threat.

This campaign serves as a stark reminder of the evolving tactics employed by cybercriminals and the critical need for robust cybersecurity hygiene in today’s digital landscape.

Indicators of Compromise (IOCs)

Type	Indicator
Domain	updaterputty[.]com
Domain	zephyrhype[.]com
Domain	putty[.]run
Domain	putty[.]bet
Domain	puttyy[.]org

Stay Updated on Daily Cybersecurity News. Follow us on Google News, LinkedIn, and X.