Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline

In a recent cybersecurity incident that demonstrates the increasing sophistication of even novice attackers, a French-speaking threat actor targeted a small automotive business with what initially appeared to be a straightforward compromise. However, the conclusion of this attack reveals an important lesson about persistence mechanisms that security professionals should note.

The attacker first infiltrated the French company's systems through undisclosed means, subsequently deploying a keylogger to capture sensitive information including banking credentials and email access. This type of data theft follows a predictable pattern observed in countless similar incidents. What distinguished this particular attack was the attacker's foresight in establishing a reliable backdoor before his primary command-and-control infrastructure became unavailable.

Security researchers discovered that as the attacker's Havoc C2 server was preparing to go offline, the intruder installed both OpenSSH and Tailscale on the compromised machine. This combination of tools created a sophisticated persistence mechanism that operated independently of the now-defunct C2 infrastructure. Tailscale, a zero-config VPN built on WireGuard, effectively established a secure peer-to-peer connection between the victim machine and the attacker, while OpenSSH provided additional remote access capabilities. This dual approach ensured