Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline

Summary: A French-speaking attacker known as "Poisson" breached a small French automotive business, planting a 70-line Python keylogger to steal banking and email credentials, then installed OpenSSH Server and Tailscale on a victim machine on April 7 to build a persistence path independent of his Havoc command-and-control server. When the C2 went offline the next day, his access survived, and when it returned on April 26 his agents reconnected automatically; Cato Networks documented 339 commands over 33 days after the operator left his SSH keys and playbook in an open storage bucket.
Why it matters: The operator was a junior on what looked like a school schedule, failed at roughly half of what he tried, and still compromised four machines using free-tier tools like DuckDNS and a cheap IONOS VPS - so pulling a C2 server offline is not remediation when OpenSSH, Tailscale, a scheduled task, and a keylogger are still running on the host.

Read the original at The Hacker News ↗