Plink SSH remote port-forward tunnel via renamed frontpage.exe

Ethan Andrews@eandrews

•updated Jul 16, 2026•5•0•10

Detects a renamed Plink/PuTTY binary (frontpage.exe) launched from C:\users\public\music\ with command-line flags -C -N -R establishing a remote SSH port-forward tunnel to a sftp@ destination on port 3522, consistent with HelloNet C2/data exfiltration tunneling.