Headscale

Reported Context (1)

This matters because fronting the DERP servers and a self-hosted Headscale instance behind a CDN is a straightforward way to make the traffic blend in, as long as Tailscale is actually speaking standard WebSockets. BOFScale Runs Tailscale In-Memory to Route C2 Traffic Through CDN-Fronted WebSockets

MITRE ATT&CK (7)

Vendors (1)

Products (7)

Tools (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.