Hackers Using PuTTY for Both Lateral Movement and Data Exfiltration
Recent investigations have revealed the abuse of the PuTTY SSH client for lateral movement and data exfiltration within compromised networks. This activity often leaves minimal forensic evidence, which investigators can still exploit.
Recent investigations have revealed the abuse of the PuTTY SSH client for lateral movement and data exfiltration within compromised networks. This activity often leaves minimal forensic evidence, which investigators can still exploit.
PuTTY, a legitimate tool for secure remote access, is increasingly utilized by threat actors due to its ability to blend malicious activity with normal administrative tasks. Attackers use PuTTY binaries such as plink.exe or pscp.exe to move between systems using SSH tunnels and exfiltrate sensitive files without deploying custom malware.
Recent campaigns have shown that SEO-poisoned downloads of PuTTY can deliver backdoors, facilitating network pivots and data theft through HTTP POST requests.
Recent investigations have revealed the abuse of the PuTTY SSH client for lateral movement and data exfiltration within compromised networks.
Despite efforts to clean logs and artifacts, PuTTY stores SSH host keys in the Windows registry at HKCU\Software\SimonTatham\PuTTY\SshHostKeys . This log contains IP addresses, ports, and fingerprints from connections, serving as a valuable record for investigators. These entries can be correlated with authentication logs and network flows to reconstruct attacker paths.
Baseline PuTTY usage via endpoint detection platforms. Hunt for registry keys and monitor SSH traffic from non-standard ports. Use tools like Velociraptor to simplify queries for SshHostKeys. Patch vulnerabilities such as CVE-2024-31497 to prevent key recovery exploits. Rotate SSH keys and restrict PuTTY usage to whitelisted hosts.
Security teams must be vigilant against the misuse of legitimate tools like PuTTY, which can mimic standard IT workflows, making detection challenging. Anomalous remote desktop protocol (RDP) scans or irregular SSH traffic post-compromise are indicators that should be monitored closely.
Based on reporting by Cyber Security News.