GBHackers
Weaponized PuTTY Delivered via Malicious Bing Ads Targets Kerberos and Active Directory services
Part of the Weaponized story · since 26 Aug 2025
- Tue 26 Aug, 17:23 UTC. GBHackers, first report. Weaponized PuTTY Delivered via Malicious Bing Ads Targets Kerberos and Active Directory services. This article, 1st of 8.
- Tue 26 Aug, 23:15 UTC. GBHackers. APT36 Targets Indian BOSS Linux Using Weaponized .desktop Shortcut Files.
- Thu 28 Aug, 08:17 UTC. GBHackers. New TamperedChef Attack Uses Weaponized PDF Editor to Steal Sensitive Data and Login Credentials.
- Thu 28 Aug, 12:31 UTC. SecurityWeek, its first report on the story. Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack.
- Thu 28 Aug, 14:45 UTC. GBHackers. Weaponized ScreenConnect RMM Tool Deceives Users into Installing Xworm RAT.
- Fri 29 Aug, 14:30 UTC. GBHackers. Weaponized PDFs and LNK Files Used in Windows Attacks.
- Fri 29 Aug, 14:30 UTC. The Hacker News, its first report on the story. Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign.
- Fri 5 Sep, 06:15 UTC. GBHackers. Colombian Malware Exploits SWF and SVG to Evade Detection.
A recent cybersecurity incident involves weaponized versions of the PuTTY SSH client being distributed through malicious Bing ads, targeting Kerberos and Active Directory services. Attackers have been using trojanized PuTTY executables to gain initial access and conduct advanced attacks since May 2024. The campaign employs sponsored ads that mimic legitimate sources, delivering payloads signed with fraudulent certificates. High-risk indicators detected include suspicious downloads and anomalous network traffic.
The malware, identified as variants of Broomstick/Oyster, establishes remote command execution and facilitates reconnaissance and privilege escalation. Key tactics include Kerberoasting, exploiting Kerberos authentication weaknesses, and creating scheduled tasks for persistence. Organizations are advised to enforce user training and maintain vetted tool repositories to mitigate such threats.
How the story developed
8 articles from 3 outlets since 26 Aug. Quiet since 5 Sep. This was the first report.
- Tue 26 Aug, 17:23 UTC. GBHackers, first report. Weaponized PuTTY Delivered via Malicious Bing Ads Targets Kerberos and Active Directory services. This article, 1st of 8.
- Tue 26 Aug, 23:15 UTC. GBHackers. APT36 Targets Indian BOSS Linux Using Weaponized .desktop Shortcut Files.
- Thu 28 Aug, 08:17 UTC. GBHackers. New TamperedChef Attack Uses Weaponized PDF Editor to Steal Sensitive Data and Login Credentials.
- Thu 28 Aug, 12:31 UTC. SecurityWeek, its first report on the story. Hackers Target Popular Nx Build System in First AI-Weaponized Supply Chain Attack.
- Thu 28 Aug, 14:45 UTC. GBHackers. Weaponized ScreenConnect RMM Tool Deceives Users into Installing Xworm RAT.
- Fri 29 Aug, 14:30 UTC. GBHackers. Weaponized PDFs and LNK Files Used in Windows Attacks.
- Fri 29 Aug, 14:30 UTC. The Hacker News, its first report on the story. Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign.
- Fri 5 Sep, 06:15 UTC. GBHackers. Colombian Malware Exploits SWF and SVG to Evade Detection.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 8 articles as a listHide the list
- Tue 26 AugDay 02
- Weaponized PuTTY Delivered via Malicious Bing Ads Targets Kerberos and Active Directory services17:23 · GBHackers · First report · This article, 1st of 8
- Thu 28 AugDay 23
- Fri 29 AugDay 32
- Weaponized PDFs and LNK Files Used in Windows Attacks14:30 · GBHackers
- Abandoned Sogou Zhuyin Update Server Hijacked, Weaponized in Taiwan Espionage Campaign14:30 · The Hacker News
Quiet for 7 days
Fri 5 SepDay 101- Colombian Malware Exploits SWF and SVG to Evade Detection06:15 · GBHackers · Picked up again