9/15/25, 9:14 AM

SEO poisoning is a tactic used to push deceptive websites to the top of search results, and Darktrace identifies a campaign in June 2025 that delivered a variant of the Oyster backdoor through trojanised PuTTY downloads. The act of typing in typosquatted domains such as putty[.]run or putty-app.naymin[.]com leads users to pages that install PuTTY while silently deploying Oyster, a C++ based backdoor that provides remote access and communicates with a command-and-control server.

Oyster’s persistence is achieved in part by a Windows Scheduled Task and DLL side loading, with a malicious DLL often named twain_96.dll invoked via rundll32.exe. The campaign included anomalous network activity, unusual user agents, and C2 traffic patterns, and in some cases involved Remote Desktop Protocol sessions to probe for further footholds.

Notably, Oyster has been linked to ransomware operations by threat actors in prior campaigns, and Darktrace’s anomaly-based detection and Autonomous Response capability helped to shut down the threat before escalation, according to Darktrace. The investigation also highlights the broader risk of MaaS and the use of initial access tools like Oyster as flexible entry points for high-value intrusions.