---
title: Hunt: SEO fake-PuTTY MSI → Node BYOI loader with EtherHiding C2 | ctxsec
url: https://ctxsec.com/items/hunt-putty-etherhiding
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-putty-etherhiding.md)

hunt idea

2026-10-13

### Hunt: SEO fake-PuTTY MSI → Node BYOI loader with EtherHiding C2

Unit 42 (Oct 12 TTI): SEO-poisoned "PuTTY" downloads serve Putty-x86_64.msi that drops a signed PuTTY 0.85 decoy plus a Node.js bring-your-own-interpreter loader. C2 URL is resolved via Ethereum `eth_call` (EtherHiding) and polled every 500 ms as fake static assets; operators push recon, cookie theft, and near-live screen streaming.

```
// KQL sketch — AppData node + msiexec→curl Node zip
DeviceProcessEvents
| where FileName =~ "node.exe" and FolderPath has @"AppData\Local"
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine
DeviceProcessEvents
| where InitiatingProcessFileName =~ "msiexec.exe"
| where FileName in~ ("curl.exe","cmd.exe") and ProcessCommandLine has "nodejs.org"
```

Also watch eth_call from non-browser processes to public Ethereum RPCs. Sketch only; validate IOCs from Unit 42 before alerting.

Sources: [Unit 42 timely threat intel](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-12-MSI-impersonating-PuTTY-delivers-malware.txt) · [@Unit42_Intel](https://x.com/Unit42_Intel/status/2110107318444499172)