Hackers Using PuTTY for Both Lateral Movement and Data Exfiltration

The article warns that attackers are increasingly abusing the legitimate PuTTY SSH client for covert lateral movement and data theft, sometimes using trojanized installers (delivering backdoors like Oyster) and exploiting PuTTY-related vulnerabilities (e.g., CVE-2024-31497). It identifies a reliable forensic artifact — SSH host keys recorded at HKCU\Software\SimonTatham\PuTTY\SshHostKeys — and recommends baselining PuTTY use, hunting registry keys, rotating SSH keys, whitelisting hosts, and monitoring anomalous SSH/exfiltration activity.