A French-speaking attacker breached a small French automotive business, installing a keylogger to steal banking and email credentials. The intrusion followed a typical pattern until an unusual pivot near the end: before his Havoc command-and-control (C2) server went dark, he installed Tailscale and OpenSSH on the victim machine.
This created a persistent backdoor that bypassed the C2 entirely. When the Havoc server became unavailable the next day, the attacker retained access through the Tailscale tunnel and SSH. The move suggests a junior operator improvising with accessible tools rather than relying on sophisticated infrastructure.
The attack vector began with initial compromise—likely via phishing or credential theft—but no CVE is associated. Indicators of compromise include unauthorized Tailscale node registration and OpenSSH service on the victim system. The keylogger captured credentials from browser sessions and email clients.
No patch addresses this specific tactic since it exploits legitimate features. Organizations should monitor for unauthorized Tailscale installations and unexpected SSH daemon processes. Network segmentation and application allowlisting can limit lateral movement from similar persistence methods.
Attribution points to a French-speaking actor, but no known group has claimed responsibility. The incident highlights how even low-sophistication attackers can extend access windows using commodity tools, raising concerns for small businesses with limited security monitoring.