Users of the PuTTY freeware terminal emulator have been sent an urgent security warning to stop using the software.
The North Korean state-backed Lazarus group, responsible for the 2016 hacking of the Bangladesh Central Bank and the 2014 Sony data breach are currently engaged in a campaign targeting open-source software. The PuTTY terminal emulator is one of the tools being compromised and weaponized by the group.
North Korean hackers are approaching employees at large organizations through LinkedIn or Email, usually offering them an exciting new job opportunity. They then move the conversation to WhatsApp where the victim will be given a url and login information. Once they visit the page and insert the login information the hackers are able to breach and traverse their network.
The Lazarus Group have gained worldwide notoriety as an APT (advanced and persistent threat) group. Their state-backing from the North Korean government has allowed them to perform spectacular and destructive hacks. The attacks are carefully planned and contain a large amount of observation and dormancy time, while the group gathers information and prepares for their eventual strike. Making them extremely hard to detect until it is too late.
This was seen during the 2016 hacking of the Bangladesh Central Bank where security experts only discovered the breach once Lazarus had drained $101 Million out of the bank, with their full target thought to be around $850 Million.
Experts have repeatedly warned that PuTTY is not a secure terminal emulator. PuTTY lacks the security functionality and accreditation of many enterprise emulators yet it is still being inadvisably used by many large organizations. Often the kind of banks and government organizations most at risk from The Lazarus Group.
This latest threat underscores how easy to exploit the insecure freeware nature of PuTTY and highlights the importance of any organization still using the emulator to stop. If you or your organization is still using PuTTY switch to another emulator now.
Jubilant offer a 30-day free trial of their secure html-based Terminal Emulator from a fully ISO accredited organization. If you are concerned about your organization's security start a conversation today.
Download TE Trial
Access Free Trial
- Easy guided installation, use instantly
- Benefit from all of the features and personal support provided by a full Jubilant licence
- Option to test with multiple devices without installing any software on the access device
Ready to get started?
- Fill in your email address to access the download, your trial key will be emailed to you instantly
- If you would like a dedicated project consultant, please provide a contact number and one of our product consultants will be in touch to provide technical and commercial support to help you get the most from your evaluation.