Poisson Used OpenSSH and Tailscale to Retain Access After Havoc C2 Went Offline
Summary
Cato Networks reconstructed an intrusion attributed to Poisson, who used OpenSSH and Tailscale to retain access to a French automotive business after its Havoc C2 went offline. The investigation also describes keylogging and persistence methods.
Key points
- Cato Networks says Poisson compromised four machines at a small French automotive business and used a keylogger to collect banking and email credentials.
- The reported malware chain used a VBScript stager, a PowerShell loader, and a .NET loader to run Havoc’s Demon agent largely in memory.
- Poisson installed OpenSSH Server and Tailscale, configuring key-based SSH and a reverse tunnel as an alternate access path.
- When the Havoc infrastructure went offline, access reportedly continued through Tailscale; the Havoc agents reconnected when the C2 returned 18 days later.
- Cato says it reconstructed 339 commands over 33 days using material the operator left in an open storage bucket.
- The investigation found no sign that Poisson took the documents he browsed, and says the contents of two executables run from Thales.zip remain unknown.
- Cato recommends hunting for unexpected OpenSSH and Tailscale use, reverse SSH tunnels, privileged scheduled tasks, and related script activity rather than relying only on C2 takedowns.
Article Details
- Attack Vectors
- A VBScript stager used a sandbox-evasion delay, decrypted a PowerShell loader, and fetched a .NET loader that ran Havoc’s Demon agent in memory.
- The operator used a scheduled task configured to run at every logon with highest privileges and injected shellcode into Explorer.exe.
- A Python keylogger recorded keystrokes to a local file; the operator later accessed the file manually to collect banking and email credentials.
- The operator installed OpenSSH Server and Tailscale, joined the victim machine to a private Tailscale network, and configured key-based SSH and a reverse tunnel to preserve access independently of the Havoc C2.
- A custom-built RustDesk installation provided a backup remote-access channel.
- Defensive Notes
- Cato recommends alerting on OpenSSH Server installations on Windows workstations, unexpected tailscale.exe execution, and ssh -R reverse tunnels to external hosts.
- Cato recommends monitoring wscript.exe running .vbs files from user staging folders, high-privilege scheduled tasks launching script interpreters, and powercfg standby-timeout changes.
- Cato recommends treating a C2 takedown as insufficient remediation and hunting for independent persistence paths, including OpenSSH, Tailscale, scheduled tasks, and keyloggers.
- Cato recommends blocking DuckDNS.
MITRE ATT&CK
T1021.004 · SSHThe operator configured key-based SSH access to the victim machine.T1053.005 · Scheduled TaskA scheduled task was configured to run at every logon with highest privileges.T1055 · Process InjectionThe operator injected shellcode into Explorer.exe.T1056.001 · KeyloggingThe Python keylogger captured user keystrokes, including banking and email credentials.T1059.001 · PowerShellA PowerShell loader was decrypted and used in the in-memory loading chain.T1059.005 · Visual BasicThe intrusion began with a VBScript stager.T1059.006 · PythonA 70-line Python keylogger recorded keystrokes to a local file.T1105 · Ingress Tool TransferThe loader chain pulled down a .NET loader.T1219 · Remote Access ToolsThe operator used Tailscale and a custom-built RustDesk installation as remote-access paths.T1497.003 · Time Based ChecksThe VBScript stager used a delay described as sandbox evasion.T1572 · Protocol TunnelingThe operator established a reverse SSH tunnel over the separate Tailscale network.
Threat Actors
Akira ransomwareThe article says RustDesk has appeared in recent Akira ransomware intrusions; it does not associate Akira with the Poisson incident.APT31The article says APT31 used Tailscale in 2024 and 2025 to tunnel out of Russian IT firms; this is cited as contextual prior use, not as involvement in the Poisson intrusion.PoissonThe article identifies Poisson as the operator who compromised four machines at a French automotive business, deployed a keylogger, and established OpenSSH and Tailscale access alongside Havoc C2.Scattered SpiderThe article says Scattered Spider has used legitimate remote-access tools such as Ngrok and Fleetdeck; this is contextual comparison, not attribution of the reported intrusion.
Malware
Products
HavocCato Networks documented how an attacker known as Poisson compromised a small French automotive business, stole credentials, and then used OpenSSH and Tailscale to keep access even after the Havoc C2 server went offline.Microsoft WindowsIt pops the Windows consent prompt and waits for someone to click Yes.OpenSSHCato Networks documented how an attacker known as Poisson compromised a small French automotive business, stole credentials, and then used OpenSSH and Tailscale to keep access even after the Havoc C2 server went offline.RustDeskAfter that came the nailing-down: a scheduled task running at every logon with highest privileges, shellcode injected into Explorer.exe, and a custom-built RustDesk as a backup channel.Tailscale VPNCato Networks documented how an attacker known as Poisson compromised a small French automotive business, stole credentials, and then used OpenSSH and Tailscale to keep access even after the Havoc C2 server went offline.
Tools
HavocCato Networks documented how an attacker known as Poisson compromised a small French automotive business, stole credentials, and then used OpenSSH and Tailscale to keep access even after the Havoc C2 server went offline.PowerShellA VBScript stager with a sandbox-evasion delay decrypted a PowerShell loader, which pulled down a .NET loader that ran Havoc’s Demon agent without dropping the implant to disk.