Like PuTTY in Admin's Hands

The LevelBlue Managed Detection and Response team handled incidents related to a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator. The malicious software, masquerading as legitimate PuTTY, was downloaded by privileged users and exhibited behaviors such as Kerberoasting, suspicious PowerShell execution, and persistence via scheduled tasks. The threat actors used sponsored ads on search engines to deliver the malware, which was signed by various entities and utilized multiple domains for distribution. The campaign highlights the importance of following security best practices across all organizational levels and emphasizes the need for robust verification mechanisms in advertising networks to prevent abuse.

• Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams InstallersMalware2025-10-02
• AI brands as bait: How threat actors are using the AI hype in social engineeringMalware2026-06-08
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Placeholder Domains Whose Ads Serve ScamsCampaign2026-09-26
• Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop IntrusionMalware2026-08-24