The door opened by OpenSSH and Tailscale the intrusion that persists when C2 fails

A French-speaking intruder identified by researchers as "Poisson" committed a small automotive company in France with techniques that, on the surface, seem routine: keylogger, bank credentials theft and remote access. What makes this case a lesson for operators and defenders is not so much the tool used, but the attacker's decision to create a return door that did not depend on his command and control server (C2). The detailed analysis was published by Cato Networks and offers an almost minute-to-minute reproduction of the operation from the attacker's own keyboard: an ideal record for those seeking to understand how they are built and maintained persistent access in low-budget environments. CTRL Cato report document how a series of apparently Andean commands crystallized in continued access, even when the infrastructure of Havoc (the C2) was out of service.

The critical maneuver was the installation of OpenSSH and Tallscale on a Windows computer, key authentication settings and a reverse SSH tunnel. In practice, this created an encrypted and private mesh of the attacker to the affected machine, avoided exposing ports and, above all, made the door open even when the traditional C2 failed. To turn off the command and control server was not enough; persistence had been transferred to a legitimate and encrypted channel. Tallscale is a legitimate and widely used service for private Internet networks, which highlights the problem: legitimate tools can be exploited for malicious operational continuity. More information about Tailscale and its model is available on your official website: https: / / tailscale.com /.

The case also shows the deliberate use of low-track techniques: Havoc's payload was almost entirely executed in memory by a .NET loader initiated by PowerShell, and the credentials were collected with a Python keylogger that was simply written locally and recovered "by hand" by the operator. The absence of direct exfiltration to a public server and legitimate channel preference reduce traditional signals that trigger IoC-based detections (static indicators). In addition, the operator took advantage of signed tools and legitimate remote customers such as RustDesk, which makes detection based only on hashes or file names easily fail.

For defenders, the operational lesson is clear: treating a C2 brought down as an end to the intrusion is a dangerous mirage. The answer must pivote quickly from "turning off the external infrastructure" to "looking for alternative internal doors." This involves auditing installed services, reviewing SSH keys and configured private networks, and verifying programmed tasks and memory persistencies. Microsoft maintains documentation on OpenSSH functionality on Windows that can serve as a response equipment reference to identify legitimate versus suspicious facilities: https: / / learn.microsoft.com /.

In practical and actionable terms, attention should be paid to several signs that the attacker repeatedly left: the presence of an OpenSSH service in workstations (rarely legitimate), the Thai scale.exe process in machines that should not run VPNs, ssh-R tunnels pointing towards external hosts, wscript.exe running .vbs from temporary user folders, and programmed tasks in "highest privileges" that launch script interpreters. It is also relevant to monitor changes in power configuration with powercfg, because keeping machines awake was part of its collection operation. These are more useful behavioral signs than a specific hash.

From the point of view of immediate mitigation, a first step is to isolate and preserve evidence: disconnect suspicious machines from the network, turn memory for forensic analysis and collect installed service configurations and programmed tasks. In the case of Tallscale, the administration console allows to remove devices and rotate keys to cut that private mesh. Beyond revoking, it is critical to search for residual devices: added SSH keys, Tailscale configuration files, installed binaries, and any script or task that relays components to reboot.

In a hardening perspective, organizations should reduce the ability to install services by standard users, implement application control policies (allowing) and limit the use of remote customers to centrally managed approved software. The lifting of privileges via Start-Process -Verb RunAs states that the UAC can be a social vector: if a user accepts repeated elevations, the attacker achieves privileges. Implement lifting approval policies, remote management controls and account segregation (domain manager, local administrator, service account) reduces the abuse area.

No less important is telemetry and behavior-based detection: EDR / EDR-like solutions should alert not only by 'known malware', but by atypical actions such as creating SSH servers in workstations, running signed processes from user routes, creating reverse tunnels and accessing credentials folders. Since the attacker used free services (DickDNS, BackBlaze B2, a cheap VPS), it is appropriate to block and monitor dynamic domains and public buckets as part of the hunting of external artifacts. The tactic of using trusted suppliers should not exempt a detection team from analysing them when they appear in suspicious context.

For small businesses, the moral system is double and hard: on the one hand, the real damage is not always sophisticated; stealing bank and email credentials requires little technique but produces direct economic impact. On the other hand, the answer cannot be limited to a simple "turn off the C2." Effective containment requires the search and removal of all the internal doors that the attacker may have created with legitimate tools and then complete cleaning and rotation of credentials with audit of access and change.

Finally, Cato's report is a reminder that effective safety combines prevention, detection and a response that assumes that intrusion can survive any partial intervention. The attacker's toolbox will always include legitimate tools and encrypted services; the difference is in a defense that seeks anomalous behavior, responds to them in an integral way and does not trust that an offline C2 means "solved problem." To deepen the case and learn the concrete indicators that researchers documented, Cato's full report is available on his blog: https: / / www.catonetworks.com / blog / and to better understand what Tallscale is and how it can be managed safely visit https: / / tailscale.com /.