Critical PuTTY Installer Vulnerability Exploited by Hackers in Google Search Attacks

Key Takeaways

• A new social engineering campaign is distributing malicious PuTTY installers via poisoned Google search results.
• The fake installers deploy a Node.js-based loader that establishes a persistent backdoor, while a legitimate PuTTY instance launches as a decoy.
• Attackers are leveraging Ethereum smart contracts for dynamic command-and-control (C2) infrastructure, making detection and blocking more challenging.
• The campaign targets IT administrators and other professionals who frequently download remote access tools.
• There is no vulnerability in PuTTY itself; the attack relies on user trust in seemingly legitimate search results and websites.

Hackers Exploit Google Search to Deliver Malicious PuTTY Installers

Cybersecurity researchers have uncovered an active campaign that leverages manipulated Google search results to distribute a trojanized version of PuTTY, a widely used SSH and Telnet client. The sophisticated attack targets IT administrators and other technical users by presenting a convincing, but fake, download page for the software. Victims who fall for the ruse and download the malicious installer unknowingly compromise their systems, allowing attackers to establish a persistent backdoor while a genuine PuTTY application launches as a deceptive front.

The campaign mirrors previous efforts to weaponize popular IT tools, but this iteration introduces new layers of evasion and control. The malicious installer, disguised as a standard Windows MSI package, initiates a multi-stage infection process. Crucially, it employs Node.js and an innovative command-and-control (C2) mechanism that utilizes Ethereum smart contracts to maintain resilience against detection and takedown efforts.

The Deceptive Download and Initial Infection

When an IT administrator searches for PuTTY on Google, they may encounter a sponsored or manipulated search result leading to a fraudulent website, such as puty[.]ink. This imposter site meticulously mimics the appearance and title of the official PuTTY download page, enhancing its credibility. Clicking the download link on this fake page retrieves a malicious MSI installer named Putty-x86_64.msi, hosted on a Backblaze B2 storage bucket.

Upon execution, the Windows Installer drops four malicious files into a user’s Local AppData directory. Simultaneously, it launches a legitimate, Sectigo-signed copy of PuTTY version 0.85. This legitimate application functions normally, providing a convincing decoy that allows the user to believe the installation was successful and secure. However, in the background, the true infection chain unfolds.

Node.js Loader and EtherHiding C2

While the legitimate PuTTY application runs, the installer covertly executes a batch file, 44JYYsqg.cmd. This script operates silently, first verifying if Node.js is present on the system. If not, it proceeds to download and install the official Node.js 18.20.5 runtime. The danger does not lie in the Node.js runtime itself, but in how attackers exploit it. The batch file then uses a small JScript file, BdbEinqaL7.js, to launch Node.js with an obfuscated JavaScript payload. This technique, where legitimate runtimes are used to execute malicious scripts, has been observed in other malware campaigns.

A significant advancement in this campaign is the attackers’ use of Ethereum smart contracts to determine their active C2 server. Instead of relying on a static, easily blockable IP address, the JavaScript loader queries a specific Ethereum smart contract through seven distinct public RPC services. It then compares the responses and selects the most common valid URL as its C2 address. This method, dubbed #EtherHiding, has been previously identified in other campaigns and significantly complicates efforts by defenders to block C2 communications, as the address can change every five minutes.

The malware communicates with its C2 server approximately every 500 milliseconds. These requests are designed to appear innocuous, mimicking downloads of common web assets like .png, .jpg, .css, or .ico files. If the C2 server responds with more than 10 bytes of data, the loader executes this response as JavaScript, leveraging Node.js functionalities. This dynamic execution capability allows the attackers to push new commands and capabilities to compromised systems without needing to replace the initial installer or modify the core malware, providing immense flexibility for post-compromise activities.

Impact on IT Environments

Analysts from Unit 42 identified this campaign, detailing the extensive capabilities granted to attackers. The malicious JavaScript payload enables adversaries to:

• Collect comprehensive system information, including operating system details, installed antivirus software, domain membership, graphics hardware specifications, and active SMB sessions.
• Exfiltrate sensitive data such as browser profiles and cookies, potentially leading to session hijacking and credential theft.
• Install additional components, including a WebSocket package, to enhance communication capabilities.
• Execute a PowerShell routine that captures desktop screenshots at a rate of approximately five images per second. These images are saved as encoded files, allowing for near real-time monitoring of user activity.

It is critical to reiterate that this campaign does not exploit any vulnerability in PuTTY itself. Instead, it relies entirely on social engineering and the user’s trust in search engine results and seemingly legitimate download sources. This is particularly concerning for IT administrators, whose machines often contain elevated privileges, cached credentials, and active connections to critical internal systems, making them high-value targets for attackers. The campaign’s tactics echo previous incidents involving trojanized utilities like WinSCP, emphasizing the ongoing threat of supply chain manipulation and deceptive downloads.

What You Should Do

• Verify Download Sources: Always download software from official vendor websites. For PuTTY, the legitimate source is PuTTY’s official site. For Node.js 18.20.5, refer to Node.js 18.20.5 for Windows. Avoid downloading tools from third-party sites or direct links from search results, especially for critical utilities.
• Implement Software Whitelisting: Maintain an approved software portal or utilize application whitelisting solutions to restrict software installations to trusted, pre-approved applications and sources.
• Monitor Process Activity: Look for unusual node.exe processes running from user AppData folders, particularly if they are launched with an .ini file argument. This behavior is indicative of the malicious loader.
• Inspect MSI Installations: Monitor Windows Installer (MSI) activities for the creation of suspicious files or folders associated with this campaign, such as 44JYYsqg.cmd, BdbEinqaL7.js, k3TjneJGcwI7.ini, or the staging folder C:Users<user>AppDataLocalidejDHjFnNXb.
• Network Traffic Analysis: Watch for outbound network connections to Ethereum RPC services (e.g., mainnet.gateway.tenderly[.]co, rpc.flashbots[.]net) from machines that do not legitimately require such access. Also, monitor for unusual HTTP/S requests to C2 patterns like /api/<4-byte-hex>/<client-UUID>/<4-byte-hex>.<png|jpg|gif|css|ico|webp>?<key>=<build-id>.
• Educate Users: Conduct regular cybersecurity awareness training, emphasizing the dangers of suspicious search results, unofficial download sites, and the importance of verifying software authenticity before installation. Remind users that a familiar program window or a valid digital signature on one bundled file does not guarantee the safety of the entire installer package.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.