In the world of cybersecurity, where threats are constantly evolving, a recent incident involving a junior hacker, known as Poisson, has shed light on the importance of understanding the intricacies of modern attack vectors. This case study, detailed by Cato CTRL researcher Vitaly Simonovich, highlights a critical oversight in traditional remediation strategies. While pulling a command-and-control (C2) server offline might seem like a successful defense, this hacker's ingenuity has shown that it's not always the end of the story.
Poisson, a French-speaking attacker, managed to breach a small French automotive business, planting a keylogger and stealing banking and email credentials. What sets this incident apart is the hacker's strategic use of OpenSSH and Tailscale, which provided a separate, persistent access point to the victim's machine, even after the C2 server went dark. This is a powerful reminder that cybersecurity professionals must think beyond the immediate threat and consider the long-term implications of an attack.
The hacker's tools and techniques are not new, but their effective use is. China's APT31 has employed Tailscale for quiet tunneling out of Russian IT firms, and the Scattered Spider has leveraged legitimate remote-access tools like Ngrok and Fleetdeck. RustDesk, Poisson's backup channel, has also been used in recent Akira ransomware intrusions. These tools are signed and legitimate, making detection based on bad files rather than bad behavior a challenge.
What makes this case particularly fascinating is the hacker's command-level proof that the trick outlives a takedown. Poisson, despite being a junior operator, demonstrated a sophisticated understanding of persistence mechanisms. He installed OpenSSH Server and Tailscale, joined the victim's machine to his private Tailscale network, and set up key-based SSH and a reverse tunnel. This allowed him to reach the machine over Tailscale's encrypted mesh with no C2 and no exposed ports.
The implications of this incident are far-reaching. When a C2 is discovered, it's crucial to assume that it's not the only way in and to actively hunt for the quiet persistence layer behind it. The remediation process must go beyond simply taking down the C2 server. It's essential to identify and address the underlying mechanisms that provide persistent access, such as OpenSSH, Tailscale, scheduled tasks, and keyloggers.
The question of what was in Thales.zip and what the two programs did during their 32 minutes on the machine remains unanswered. However, the more critical takeaway is that the C2 was never the primary intrusion point. The real vulnerability lies in the persistence mechanisms that allow an attacker to maintain access even when the C2 is offline.
In conclusion, this incident serves as a stark reminder that cybersecurity professionals must adopt a holistic approach to defense. While taking down a C2 server is a necessary step, it's not sufficient. By understanding the persistence mechanisms employed by attackers, we can develop more robust and comprehensive strategies to protect our systems and data. As the threat landscape continues to evolve, it's crucial to stay one step ahead and adapt our defenses accordingly.
