A low-skilled threat actor known as “Poisson” carried out a multi-stage credential theft campaign aimed at French individuals and a small business. The attacker used Havoc C2, a custom Python keylogger, and built resilient access through OpenSSH and a Tailscale VPN mesh. This setup allowed the operator to retain access even after the main command-and-control infrastructure was disrupted.
Cato CTRL conducted an in-depth post-incident review covering 33 days of attacker activity and 339 recorded commands. The investigation revealed use of free-tier services such as Backblaze B2, DuckDNS, and IONOS, along with a persistence design intended to survive C2 takedowns. Researchers also recovered the operator’s SSH playbook and victim SSH keys, which had been mistakenly exposed in a public storage bucket.
Defenders should generate alerts for OpenSSH server deployment on workstations and monitor for Tailscale VPN activity on systems where it is not expected. Organizations also need to detect SSH reverse tunnels and track suspicious scheduled tasks running with elevated privileges. Effective remediation must go beyond removing C2 access and include elimination of mesh-VPN-based persistence mechanisms.
When this activity is identified, security teams should immediately locate and dismantle any active Tailscale or SSH mesh connections. Investigators should review all scheduled tasks and startup shortcuts for unauthorized persistence. A full credential reset is strongly recommended for all users, since the use of a keylogger creates a high likelihood of credential compromise.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary, simulating the “Poisson” group, aims to establish a remote access foothold. First, they stage a payload by creating a file named thales.zip in a temporary directory. To elevate privileges, they execute a PowerShell command using the RunAs verb, which is a common method for triggering UAC prompts. Finally, they execute rustdesk.exe to provide a secondary remote desktop communication channel. This sequence mimics the specific behavioral pattern (UAC elevation + RustDesk + specific zip file) defined in the detection rule.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
