Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising

A malvertising campaign advertised fake Putty and WinSCP download sites (typosquatting domains) to deliver trojanized installers that use DLL sideloading to load a malicious python311.dll; the payload extracts and runs an encrypted Python script that installs the Sliver post-exploitation framework, enabling Cobalt Strike deployment, data exfiltration attempts, and an attempted ransomware encryptor (ransomware execution was reportedly blocked).