Junior Hacker Used Tailscale and OpenSSH to Maintain Persistent Access After C2 Outage

A French-speaking attacker, operating under the handle ‘Poisson,’ breached a small French automotive business using a keylogger to steal banking and email credentials. The intrusion, detailed by Cato CTRL researcher Vitaly Simonovich, is notable for the attacker’s use of Tailscale and OpenSSH to maintain access after his Havoc command-and-control (C2) server went offline.

The attack chain began with a VBScript stager that decrypted a PowerShell loader, which then pulled a .NET loader to run Havoc’s Demon agent entirely in memory. For privilege escalation, the attacker used Start-Process -Verb RunAs, which triggers a UAC prompt. Persistence was achieved via a scheduled task, shellcode injection into Explorer.exe, and a custom RustDesk backup channel. The keylogger, a 70-line Python script, wrote keystrokes to a local file without exfiltration; the attacker manually retrieved it.

The critical move occurred on April 7, when Poisson installed OpenSSH Server and Tailscale, joining the victim’s machine to his private Tailscale network and setting up key-based SSH with a reverse tunnel. This created a separate access path independent of the C2. When the Havoc infrastructure went offline the next day, the attacker retained access via Tailscale. When the C2 returned on April 26, agents reconnected automatically. Over the final five days, the attacker ran 145 commands, probed smart-card and certificate stores, executed two programs from a file named Thales.zip for 32 minutes, then deleted 17 files and went silent on May 1.

Researchers emphasize that pulling a C2 server offline is insufficient remediation if attackers have built alternative persistence. The attacker’s tradecraft was thin—he leaked his home directory five times and named buckets after his handle—yet he compromised four machines. Cato Networks provides a hunting list: alert on OpenSSH Server installation on workstations, tailscale.exe on non-VPN machines, ssh -R reverse tunnels, wscript.exe running .vbs from staging folders, scheduled tasks with highest privileges, and powercfg standby-timeout changes. The article underscores that the C2 was never the intrusion, just one way into it.