News

A French-speaking attacker infiltrated a small automotive firm in France, deployed a keylogger, and harvested banking and email credentials. That alone would be unremarkable, except for one critical step late in the intrusion: before his command-and-control (C2) infrastructure dropped offline, he installed OpenSSH and Tailscale on a compromised workstation, creating an alternate access route that bypassed the original C2 entirely.

The Havoc C2 went dark the following day, but the attacker’s foothold remained. Eighteen days later the C2 came back online and the agents reconnected automatically-no re-compromise needed. Cato Networks recorded the full sequence of commands, 339 in total across 33 days, after the operator mistakenly left SSH keys and a detailed playbook in an open storage bucket. The incident write-up, published by Cato CTRL researcher Vitaly Simonovich, offers the unusual perspective of seeing an intrusion play out from the attacker’s keyboard rather than reconstructed from artifacts.

The researchers’ takeaway is stark: taking down a C2 is insufficient if an adversary has already implanted a separate, stealthy entry point. The intruder, who used the handle “Poisson,” is not a nation-state APT. Cato’s analysis paints the operator as a junior-level actor with an apparent daytime schedule-active after about 15:00 CET with a long noon break-and running on free or cheap infrastructure: DuckDNS, Backblaze B2, and an inexpensive IONOS VPS hosted in Berlin.

His tradecraft was rudimentary. He exposed his home directory on multiple occasions, named cloud storage buckets after his alias, and even left a test file containing repeated keystrokes inside the keylogger package. He failed roughly half of his attempts, yet still managed to compromise four machines.

How the intrusion unfolded: the malicious payload largely executed in memory. A VBScript stager that included a sandbox-evasion delay decrypted a PowerShell loader. That loader fetched a .NET stub which launched Havoc’s Demon agent without writing the implant to disk. For privilege escalation he used Start-Process -Verb RunAs, which triggers the Windows UAC consent dialog rather than silently bypassing it; on one victim it required around a dozen attempts over two days before someone clicked Yes.

After gaining higher privileges, he established persistence with a scheduled task set to run at each logon with the highest privileges, injected shellcode into Explorer.exe, and deployed a custom-built RustDesk binary as a fallback remote channel. The credential theft component was a compact, 70-line Python keylogger that recorded keystrokes to a local file; it did not beacon or push data to an exfil server. Instead, Poisson later authenticated to the machines, manually retrieved the local log files, and used powercfg to prevent the systems from sleeping so harvesting would continue uninterrupted.

The decisive maneuver occurred on April 7 during a five-hour overnight session: he installed the OpenSSH Server and Tailscale, joined the infected endpoint to his private Tailscale network, and configured key-based SSH plus a reverse tunnel. This gave him encrypted remote access over Tailscale’s mesh network without exposing ports or relying on the Havoc C2. When the Havoc infrastructure went offline the next day-for reasons Cato does not specify-the Tailscale connection remained operational because it lived on a separate network path.

When the attacker’s C2 returned on April 26, the compromised agents reattached automatically. Over the last five days of observed activity he executed another 145 commands, inspected smart-card and certificate stores (suggesting interest in certificate-based authentication), ran two unknown executables extracted from a file named Thales.zip for about 32 minutes in total, deleted 17 files, and then ceased activity on May 1.

The intruder’s objectives were limited and focused: no Mimikatz dumps, no lateral movement, no ransomware deployment, and no obvious bulk document exfiltration. Instead, he targeted what people type-credentials for banking sites, email accounts, and government portals-precisely the data that can lead directly to financial theft for a small business owner.

None of the components he used are novel. Tailscale has been used by other threat groups-China’s APT31 leveraged it in 2024-2025 to tunnel out of Russian IT firms, and criminal actors such as Scattered Spider favor legitimate remote-access services like Ngrok and Fleetdeck. RustDesk, Poisson’s fallback channel, has also appeared in Akira ransomware incidents. Because these binaries are legitimate and often signed, detections that focus only on malicious files rather than anomalous behavior are likely to miss them.

What this case adds is operator-level command evidence that a takedown of a C2 can be ineffectual if the attacker has already created an independent access route-and that even a relatively inexperienced operator can make that mistake. Cato’s hunting checklist is concrete and actionable:

• Alert on OpenSSH Server installations on Windows workstations, which are rarely legitimate in that context.
• Detect tailscale.exe on endpoints that have no business running a VPN client.
• Look for ssh -R reverse tunnels pointing to external hosts.
• Monitor for wscript.exe executing .vbs files from user staging directories.
• Flag scheduled tasks configured to run with highest privileges that invoke script interpreters.
• Watch for powercfg standby-timeout changes that prevent systems from sleeping.
• Block DuckDNS as a low-cost mitigation for opportunistic infrastructure abuse.