SEO-Poisoned Fake PuTTY Downloads Deliver Oyster Backdoor
Summary
Darktrace analyzed a campaign that used fake PuTTY download sites promoted through search results to deliver the Oyster backdoor, observing persistence, command-and-control traffic, possible data exfiltration, and unusual RDP activity.
Key points
- In a campaign identified in June 2025, fake PuTTY sites such as putty[.]run led users to malicious installers hosted on separate domains.
- The installer deployed a functional PuTTY copy alongside Oyster, a backdoor also known as Broomstick or CleanUpLoader.
- Oyster used a scheduled task for persistence and DLL sideloading, including execution of a malicious DLL through rundll32.exe.
- Darktrace observed C2 traffic with unusual URI paths and spoofed user-agent strings, including “WordPressAgent.”
- In one case, an infected device downloaded a ZIP file and made HTTP POST requests consistent with possible data staging and exfiltration.
- Anomalous RDP sessions and scanning followed some infections, suggesting possible lateral movement; the article does not confirm ransomware deployment in these cases.
- Darktrace reported that its network detection identified malicious activity and that Autonomous Response could block the threat when configured.
Article Details
- Attack Vectors
- SEO poisoning and typosquatted PuTTY download sites deliver a trojanized installer that installs PuTTY while deploying the Oyster backdoor.
- The malware uses DLL side-loading, including a DLL often named twain_96.dll executed through rundll32.exe.
- Oyster communicates with command-and-control infrastructure over HTTP and may download additional files.
- Observed follow-on activity included RDP sessions and scanning, and probable data exfiltration via outbound HTTP POST requests.
- Defensive Notes
- Darktrace reports that its anomaly-based network detection identified malicious activity and that Autonomous Response could shut down the threat when properly configured.
- Monitor for connections to typosquatted software-download domains, rare external IP addresses, Oyster-associated URI patterns, and suspicious HTTP user-agent strings such as WordPressAgent.
- Investigate scheduled tasks running every few minutes, DLL side-loading through rundll32.exe, unusual RDP activity, and outbound HTTP POST requests with upload-like paths.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | putty-app[.]naymin[.]com | Typosquatted PuTTY endpoint identified as an indicator in the campaign. |
| DOMAIN | putty[.]run | Typosquatted PuTTY download domain used to lure users in the SEO-poisoning campaign. |
| IPV4 | 185[.]196[.]8[.]217 | Listed as an Oyster campaign indicator; associated with malicious activity. |
| IPV4 | 185[.]208[.]158[.]119 | Listed as an Oyster campaign indicator; associated with malicious activity. |
| IPV4 | 85[.]239[.]52[.]99 | Listed as an Oyster campaign indicator; associated with malicious activity. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe investigation observed anomalous RDP sessions following Oyster C2 communications.T1041 · Exfiltration Over C2 ChannelAn incident showed probable data exfiltration via outbound HTTP POST requests with an upload path.T1046 · Network Service DiscoveryDarktrace detected RDP scanning that the article describes as probing for accessible systems.T1053.005 · Scheduled TaskOyster persistence involved creating a Windows Scheduled Task that runs every few minutes.T1059.003 · Windows Command ShellThe backdoor relies on cmd.exe to execute commands and launch other files.T1071.001 · Web ProtocolsOyster communicated with command-and-control infrastructure using HTTP and campaign-specific URI patterns.T1105 · Ingress Tool TransferAn infected device downloaded a ZIP file via curl after the initial payload-delivery chain.T1574.001 · DLLThe infection used DLL side-loading, with a malicious DLL executed through rundll32.exe.
People
Threat Actors
Malware
BroomstickOyster, also known as Broomstick or CleanUpLoader, is a C++ based backdoor malware first identified in July 2023. It enables remote access to infected systems, offering features such as command-line interaction and fileCleanUpLoaderOyster, also known as Broomstick or CleanUpLoader, is a C++ based backdoor malware first identified in July 2023. It enables remote access to infected systems, offering features such as command-line interaction and fileOysterWhat is the Oyster backdoor?
Vendors
Products
Microsoft WindowsPuTTY is a free and open-source terminal emulator for Windows that allows users to connect to remote servers and devices using protocols like SSH and Telnet.PuTTYAs part of SEO poisoning, the attacker will first register a typo-squatted domain, slightly misspelled or otherwise deceptive versions of real software sites, such as putty[.]run or puttyy[.]org.