Malicious Bing Ads deploy Weaponized PuTTY to Exploit Kerberos and Attack Active Directory services

A malvertising campaign using sponsored results on Microsoft’s search platform delivered a weaponized PuTTY that established persistence, enabled hands-on keyboard control, and executed Kerberoasting to target Active Directory service accounts.

According to an investigation published by LevelBlue’s MDR SOC and corroborated by independent research tracking Oyster/Broomstick backdoor activity tied to trojanized admin tools distributed via search ads and SEO poisoning.

LevelBlue’s SOC received a SentinelOne high-risk alert in USM Anywhere, flagging a suspicious PuTTY.exe download signed by “NEW VISION MARKETING LLC,” an unexpected signer for legitimate PuTTY and the first red flag on the endpoint.

The analysis highlighted outbound traffic from PuTTY.exe to malicious infrastructure, suspicious DLL creation in %appdata% and %temp%, scheduled-task persistence via rundll32 DllRegisterServer, and HOK activity culminating in Kerberoasting. 

Next, the asset was isolated, the account was disabled, and execution chains were reconstructed. This revealed that the fake installer had scheduled a task, “Security Updater,” to run every three minutes, loading a malicious DLL (twain_96.dll). This DLL then dropped “green.dll,” which was used for operator access and reconnaissance.

Weaponized PuTTY to Exploit Kerberos

Fake PuTTY with an anomalous code-signing certificate executed and created a scheduled task persistence, invoking rundll32 with DllRegisterServer at three-minute intervals.

The first-stage DLL (twain_96[.]dll) dropped a second-stage (green[.]dll) that initiated a single outbound 443 connection and spawned cmd[.]exe for discovery commands consistent with ransomware operator TTPs (nltest, net group domain admins, nltest /dclist).

SentinelOne telemetry and VirusTotal classifications mapped the DLLs to the Oyster/Broomstick backdoor family known for hardcoded C2, scheduled-task persistence, and remote command execution.

The final recorded action was an inline PowerShell script performing Kerberoasting, requesting TGS tickets for SPN-bearing accounts and leveraging weak RC4-HMAC if AES enforcement was absent, then extracting ticket bytes in-memory to emit Hashcat-ready $krb5tgs$ material (mode 13100).

The script borrowed from Invoke-Kerberoast patterns, executed fully in-memory without disk writes, and was validated via USM Anywhere events showing RC4-HMAC-encrypted Kerberos service tickets (Event ID 4769). This enabled offline cracking of service account credentials for privilege escalation and lateral movement against AD services.

LevelBlue traced the initial access to malicious sponsored results impersonating putty[.]org and redirecting to typosquatted domains such as puttyy[.]org and puttysystems[.]com that delivered the trojanized installer, with payload hosting observed via heartlandenergy[.]ai and a rotating loader script at putty[.]network pulling from compromised WordPress sites.

The MDR team noted variant payload hashes, multiple code-signing certificates (including NEW VISION MARKETING LLC) to evade hash/signer-based detections, and alternate scheduled-task names such as “FireFox Agent INC” in sandboxed samples.

This activity aligns with broader 2024–2025 malvertising/SEO poisoning trends delivering trojanized PuTTY/WinSCP and Oyster/Broomstick, as reported by Rapid7 and Arctic Wolf.

Here is a consolidated table of the reported IOCs from the LevelBlue investigation into weaponized PuTTY malvertising tied to the Oyster/Broomstick backdoor; add these to blocklists and detection pipelines for rapid containment. The entries below reflect the indicators documented by LevelBlue and aligned open-source reporting on the same campaign.

Below is the consolidated IOC table combining domains, hashes, signers, IPs, URLs, and scheduled tasks linked to the weaponized PuTTY/Oyster malvertising activity. Use these indicators for blocklists, retro-hunting, and detection content.

Recommendations include blocking the identified domains, enforcing AES for Kerberos on SPN accounts, rotating credentials for affected SPNs, and restricting software acquisition to vetted repositories and official vendor sites.

Security teams should deploy custom detections for rundll32 DllRegisterServer misuse, three-minute recurring scheduled tasks, in-memory Kerberoasting patterns, and storyline correlations linking fake admin tools to DLL drops and cmd.[]exe reconnaissance.

Continuous user training for privileged staff and rapid MDR-led threat hunting across fleets can reduce dwell time and blunt credential theft-to-ransomware escalation paths.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.