A French-speaking attacker infiltrated a small automotive business in France, deploying a keylogger to harvest banking credentials and email logins. While the intrusion itself was conventional, the attacker’s final move before his command-and-control (C2) server was taken offline revealed a critical blind spot in standard incident response. By installing OpenSSH Server and Tailscale on the victim’s machine, he established a persistent backdoor that operated entirely outside the C2 infrastructure. When the Havoc C2 server went dark the next day, his access remained intact. Eighteen days later, the C2 came back online, his agents reconnected autonomously, and the operation resumed without interruption.
Researchers at Cato Networks captured the entire operation, logging 339 commands over 33 days after the attacker—operating under the handle “Poisson”—left his SSH keys and a detailed playbook in an unsecured storage bucket. The analysis, published by Cato CTRL researcher Vitaly Simonovich, offers a rare, keystroke-level view of an intrusion from the operator’s perspective. The lesson is direct: taking a C2 server offline is not a complete remediation if the attacker has already built a separate, resilient access path.
The Poisson Intrusion: A Junior Operator’s Playbook
Poisson is not an advanced persistent threat (APT). Researchers describe a junior operator working on what appears to be a school schedule—active after 3 p.m. CET with a long midday gap—running his entire operation on free-tier tools: DuckDNS, Backblaze B2, and a cheap IONOS VPS in Berlin. His tradecraft was thin. He leaked his home directory five times, named his storage buckets after his own handle, and left a test file of his own keystrokes typed repeatedly inside the keylogger package. He failed at roughly half of what he attempted, yet still managed to compromise four machines.
The malware ran almost entirely in memory. A VBScript stager with a sandbox-evasion delay decrypted a PowerShell loader, which pulled down a .NET loader that executed Havoc’s Demon agent without writing the implant to disk. For privilege escalation, he used Start-Process -Verb RunAscodecodecodecodecodecode, a technique that triggers the Windows User Account Control (UAC) prompt and waits for a user to click “Yes.” On one victim machine, it took a dozen attempts across two days before the prompt was accepted. After gaining elevated access, he locked down persistence: a scheduled task running at every logon with highest privileges, shellcode injected into Explorer.execodecodecodecodecodecode, and a custom-built RustDesk instance as a backup channel. His credential grabber was a 70-line Python keylogger that wrote keystrokes to a local file, with no beacon and no exfiltration server. Poisson would log in manually, retrieve the file, and run powercfgcodecodecodecodecodecode to prevent the machines from sleeping, ensuring continuous harvesting.
How OpenSSH and Tailscale Created a Persistent Backdoor
The critical pivot came on April 7, during a five-hour overnight session. Poisson installed OpenSSH Server and Tailscale on the victim’s machine, joined it to his private Tailscale network, and configured key-based SSH authentication along with a reverse tunnel. This move meant he could reach the machine over Tailscale’s encrypted mesh network with no reliance on the C2 server and no exposed ports. The next day, the Havoc infrastructure went offline. Cato Networks does not specify why, but the reason is largely irrelevant: the Tailscale path operated on a separate network, so the attacker’s access remained alive. When the C2 returned on April 26, the agents reconnected automatically—no re-compromise required. Over the final five days, Poisson ran 145 more commands, probed smart-card and certificate stores (a sign he was evaluating certificate-based authentication), executed two unexplained binaries from a file named Thales.zipcodecodecodecodecodecode for about 32 minutes, then deleted 17 files and went silent on May 1.
What the attacker wanted was narrow. There was no Mimikatz, no lateral movement, no ransomware, and no evidence he exfiltrated the documents he browsed—from tax records to insurance files. He was interested only in what people type: banking logins, email passwords, and government portal credentials. For a small business owner, that is direct, immediate financial exposure.
Why This Attack Matters for Incident Response
None of the tools used in this intrusion is new. Chinaaaa-linked APT31 used Tailscale through 2024 and 2025 to tunnel out of Russian IT firms. Scattered Spider has relied on legitimate remote-access tools like Ngrok and Fleetdeck. RustDesk, Poisson’s backup channel, has appeared in recent Akira ransomware intrusions. All the binaries involved are signed and legitimate, so detection systems that stop at malicious file signatures rather than anomalous behavior will miss them entirely. What Poisson adds is command-level evidence that a backdoor built with legitimate tools can outlive a C2 takedown—and that a junior attacker can execute it.
The implication for defenders is clear: when you discover a C2 channel, assume it is not the only way in. Hunt aggressively for the quiet persistence layer that may already be running behind it.
What Security Teams Should Monitor Now
Cato Networks provides a concrete hunting checklist based on this incident:
- Alert when OpenSSH Server is installed on a Windows workstation—that is rarely a legitimate action.
- Monitor for
tailscale.execodecodecodecodecodecode running on machines that have no business running a VPN. - Look for
ssh -Rcodecodecodecodecodecode reverse tunnels connecting to external hosts. - Watch for
wscript.execodecodecodecodecodecode executing .vbs files from user staging folders. - Flag scheduled tasks configured with highest privileges that launch script interpreters.
- Detect
powercfgcodecodecodecodecodecode changes that disable standby timeout to keep machines awake. - Consider blocking DuckDNS, a free dynamic DNS service frequently abused by threat actors.
The open question is what was inside Thales.zipcodecodecodecodecodecode and what those two programs accomplished in their 32 minutes of execution. But the more important takeaway is structural: the C2 was never the intrusion itself—it was just one path into it. Kill that path while leaving OpenSSH, Tailscale, the scheduled task, and the keylogger running, and the attacker still has a way back in. That is the part that incident response consistently overlooks.
What Affected Users Should Do Now
If you suspect a similar intrusion—or have recently experienced a breach involving C2 infrastructure—assume that removing the C2 server alone is insufficient. Immediately audit all workstations for unauthorized installations of OpenSSH Server, Tailscale, or other remote-access tools. Review scheduled tasks for those running with elevated privileges from user staging folders. Change all passwords for banking, email, and government portals, and enable multi-factor authentication (MFA) wherever available. Monitor network logs for reverse SSH tunnels and unexpected VPN connections. Finally, deploy an endpoint detection and response (EDR) solution that focuses on behavioral analytics rather than signature-based detection, as legitimate binaries used maliciously will bypass traditional antivirus software.
