The recent cyber-attack on a small French automotive business has revealed a sophisticated strategy employed by a junior hacker, known as Poisson, to maintain access to a victim's machine even after the command-and-control (C2) server went offline. Poisson's approach involved using Tailscale and OpenSSH to create a separate, encrypted connection that did not rely on the C2 server. This method highlights the limitations of traditional C2 server takedowns, as the attacker can still maintain access through alternative means.
The attacker, Poisson, installed OpenSSH Server and Tailscale on the victim's machine, allowing them to reach the machine over Tailscale's encrypted mesh without exposing any ports. When the C2 server went offline, Poisson's access was not compromised. This incident underscores the importance of recognizing that C2 servers are not always the sole entry point into a compromised system. As Cato Network's researcher Vitaly Simonovich notes, when a C2 server is taken down, it is crucial to assume that the attacker has already built alternative access methods.
Poisson's tradecraft was not highly advanced, as evidenced by his failure to cover his tracks. He leaked his home directory multiple times, named his storage buckets after his own handle, and left a test file of his own keystrokes inside the keylogger package. Despite these shortcomings, Poisson was still able to compromise four machines and steal banking and email credentials.
The malware used by Poisson was designed to run almost entirely in memory, using a VBScript stager and a sandbox-evasion delay to decrypt a PowerShell loader. This loader then downloaded a .NET loader that ran the Havoc Demon agent without dropping the implant to disk. Poisson also used a scheduled task running at every logon with highest privileges, shellcode injected into Explorer.exe, and a custom-built RustDesk as a backup channel.
The key move that allowed Poisson to maintain access was the installation of OpenSSH Server and Tailscale. By setting up key-based SSH and a reverse tunnel, Poisson created a separate, encrypted connection that did not rely on the C2 server. This allowed him to reach the machine over Tailscale's encrypted mesh, even when the C2 server was offline.
The implications of this attack are significant, as it demonstrates the importance of recognizing alternative access methods and the limitations of traditional C2 server takedowns. As Cato's hunting list suggests, organizations should be alert for signs of OpenSSH Server installation, Tailscale usage, and other indicators of potential persistence layers. By proactively addressing these issues, organizations can better protect themselves against sophisticated cyber-attacks.
