Analysis of a Junior Threat Actor Leveraging Legitimate Remote Access Tools to Maintain Persistence Beyond Command-and-Control Infrastructure Disruption
Researchers observed a French-speaking threat actor known as "Poisson" compromise a small automotive business and maintain unauthorized access for more than a month. The attacker deployed a keylogger, harvested credentials, established persistence mechanisms, and abused legitimate remote administration tools including OpenSSH, Tailscale, and RustDesk.
The most significant finding was the attacker's use of Tailscale and OpenSSH to create an alternate access path independent of the Havoc command-and-control infrastructure. Even after the C2 server went offline, access to the victim environment remained intact through the attacker-controlled Tailscale network.
Poisson
High
Credential Theft
Havoc
Small Business
High
The threat actor known as Poisson appears to be a relatively inexperienced cybercriminal operating primarily during afternoon and evening hours in Central European Time. Despite limited operational security and multiple mistakes, the attacker successfully compromised several systems using publicly available tools and low-cost infrastructure.
Victim environment breached and malware deployment initiated.
Scheduled tasks and process injection techniques deployed.
Custom Python keylogger installed for harvesting credentials.
OpenSSH Server and Tailscale installed for independent persistence.
Havoc command-and-control infrastructure becomes unavailable.
Havoc infrastructure returns and agents reconnect automatically.
Final observed activity and operational cleanup.
The exact intrusion vector remains unknown, but the attacker successfully gained access to victim systems and began executing malicious scripts.
A VBScript stager executed a PowerShell loader that downloaded a .NET loader responsible for running the Havoc Demon implant entirely in memory.
The attacker attempted elevation using Windows User Account Control prompts through Start-Process with administrative execution requests.
Persistence was achieved through scheduled tasks, process injection into Explorer.exe, RustDesk deployment, OpenSSH installation, and Tailscale network enrollment.
A custom Python keylogger captured user keystrokes and stored them locally for manual collection by the attacker.
The Havoc framework served as the primary command-and-control platform before the attacker established alternative access channels.
OpenSSH and Tailscale enabled direct access to victim systems even when command-and-control infrastructure became unavailable.
| Category | Tool |
|---|---|
| C2 Framework | Havoc |
| Remote Access | RustDesk |
| VPN Access | Tailscale |
| Remote Shell | OpenSSH |
| DNS Service | DuckDNS |
| Cloud Storage | Backblaze B2 |
| Hosting | IONOS VPS |
| Tactic | Observed Technique |
|---|---|
| Execution | PowerShell |
| Persistence | Scheduled Task |
| Persistence | Remote Services |
| Privilege Escalation | Valid Accounts |
| Defense Evasion | Process Injection |
| Credential Access | Keylogging |
| Command and Control | Application Layer Protocol |
| Exfiltration | Manual Credential Collection |
This campaign demonstrates that legitimate administrative tools can provide highly effective persistence. The attacker's most significant success was not malware deployment but the creation of alternative access channels using trusted software.
Organizations that focus solely on removing malware or disabling command-and-control infrastructure may overlook secondary persistence mechanisms that allow attackers to maintain long-term access.