FLIPSIDE

Executive Summary

FLIPSIDE is a Windows tool similar to Plink used by FIN5 to maintain access via covert SSH tunnels. It enables attackers to establish persistent L2 channels while blending with legitimate traffic, facilitating data exfiltration or lateral movement within victim networks.

FLIPSIDE is a lightweight Windows-based utility that closely mirrors the functionality of Plink, PuTTY’s command‑line interface for SSH. It was first documented by Mandiant in their October 2016 GRRCON report as part of FIN5 operations, indicating its use as an instrument for maintaining long‑term footholds within targeted networks. The tool is designed to simplify the creation of SSH tunnels and port forwards from compromised hosts back to an attacker’s infrastructure. By leveraging standard TCP/SSH protocols it sidesteps many basic security controls such as file‑based malware signatures, instead establishing covert, high‑speed command and control channels that blend with legitimate network traffic. This approach allows FIN5 to exfiltrate data or pivot laterally while minimizing the risk of detection. Because FLIPSIDE is essentially a wrapper around Plink, it inherits the same command‑line argument parsing and encryption capabilities. Analysts have observed its deployment via batch files that execute automatically once the host registers in the attacker’s infrastructure. While not designed for persistence by itself, it can be combined with other tools (e.g., scheduled tasks) to ensure continued access even after OS restarts. Overall, FLIPSIDE represents a tactical utility focused on simplifying SSH‑based communications rather than delivering standalone malicious payloads. Its presence in an environment should prompt investigators to look for anomalous outbound SSH connections and the use of PuTTY/Plink binaries that originate from compromised hosts.

Key Capabilities

• Establishes SSH tunnels for remote communication
• Creates port forwards between compromised hosts and attacker infrastructure
• Facilitates covert command‑and‑control over standard SSH ports
• Can be executed via batch scripts or scheduled tasks to maintain persistence

ATT&CK Techniques

Recommended Actions

• Conduct host‑based IOC scans for the FLIPSIDE executable or associated Plink binaries
• Monitor outbound TCP traffic on common SSH ports (22, 2222) for unexpected connections from internal hosts
• Inspect system schedules and registry run keys for anomalous execution entries using Flipside
• Deploy network IDS rules to detect high latency SSH tunnels typical of exfiltration channels

Suggested Tags