Most cybersecurity incidents follow a familiar arc: an attacker gains access, deploys tooling, exfiltrates data, and eventually disappears when defenders respond or infrastructure collapses. What makes this case worth examining closely is the moment a relatively unsophisticated actor made a tactically mature decision — one that separates opportunistic script kiddies from threat actors with genuine staying power.
The Anatomy of a Low-Profile Intrusion
The target was a small French automotive business — not a critical infrastructure operator, not a Fortune 500 enterprise. The attacker, assessed to be French-speaking, executed what initially appeared to be a routine compromise. A keylogger was deployed, banking credentials were harvested, and email account access was stolen. By most operational definitions, the mission was already complete.
But before the attacker's command-and-control infrastructure — built on the post-exploitation framework Havoc — went offline, something more deliberate happened. The actor took steps to ensure that losing the C2 server would not mean losing the foothold entirely.
The Pivot That Changes Everything
OpenSSH and Tailscale were installed directly onto the compromised machine. On the surface, neither tool raises immediate alarms. OpenSSH is a ubiquitous remote access utility found in nearly every IT environment. Tailscale is a commercially available, well-regarded mesh VPN product used by developers and businesses worldwide for secure remote connectivity.
That legitimacy is precisely the point.
By establishing a Tailscale node on the victim machine, the attacker created an encrypted, peer-to-peer tunnel that routes entirely through Tailscale's coordination infrastructure — completely independent of any malicious C2 server. When the Havoc infrastructure went dark, this secondary channel remained fully operational.
This technique is a textbook example of living-off-the-land methodology extended into the persistence phase. Rather than relying on custom malware that can be fingerprinted and blocked, the attacker leaned on software that security tools are often configured to trust — or at minimum, not flag as inherently hostile.
Why This Matters Beyond One Small Business
The victim in this case was a small business with presumably limited security resources. But the tactic itself scales. Tailscale and similar mesh VPN products — WireGuard-based or otherwise — are increasingly attractive as persistence mechanisms precisely because:
This represents a maturation of technique that defenders need to anticipate — not just in sophisticated APT operations, but in the long tail of opportunistic cybercrime targeting small and mid-sized businesses.
Detection Challenges and the Visibility Gap
Security teams relying primarily on endpoint detection focused on known-malicious binaries will struggle here. The real detection opportunity lies in behavioral analytics: Was Tailscale installed by an unexpected user account? Was OpenSSH enabled on a workstation where it has no business being active? Did a new network node appear on a coordination service that the organization doesn't formally use?
These are the questions that require mature endpoint telemetry, network traffic analysis, and — critically — a baseline of what normal looks like in a given environment. For small businesses, that baseline rarely exists.
What You Should Do
- Audit your approved software list and enforce it. Unauthorized installation of remote access tools — including legitimate ones like Tailscale, AnyDesk, or ngrok — should trigger immediate investigation, not just a log entry.
- Monitor for new SSH service activations on endpoints. OpenSSH running on a user workstation is almost never expected behavior in a standard business environment.
- Implement application whitelisting or control policies. Even basic controls that prevent unauthorized software execution would have disrupted this intrusion chain significantly.
- Treat incident response as infrastructure-agnostic. Severing C2 communications is necessary but not sufficient. Assume persistence mechanisms may exist that don't depend on attacker-controlled servers.
- Review outbound connections to mesh VPN coordination services. Unexpected traffic to Tailscale, ZeroTier, or similar coordination endpoints on endpoints that don't formally use these services warrants investigation.
- Conduct thorough post-incident forensics. Even when an attack appears contained, look for secondary persistence before declaring remediation complete.
The Broader Signal
Cybersecurity practitioners often fixate on the tools and techniques used by sophisticated nation-state actors. But this case is a reminder that tactically sound decisions don't require advanced resources — they require observation and adaptation. An attacker who understands that C2 infrastructure is a liability and prepares for its loss is thinking operationally, regardless of their overall skill level.
As these techniques propagate through threat actor communities, organizations of every size need to assume that a successful intrusion may leave behind access channels that look indistinguishable from legitimate remote administration. Detection has to move beyond malware signatures and into the harder, more contextual work of behavioral analysis. The tools are legitimate. The intent is not.
