Operation Poisson Analysis: C2-Independent Persistence Using Tailscale

Operation Poisson describes a 33-day intrusion campaign conducted by a French-speaking junior operator against French individuals and a small automotive business. While the actor exhibited poor operational security—leaking local directories and playbook details in public storage buckets—they successfully maintained access through innovative use of legitimate tools. The primary objective was credential theft targeting banking and government portal logins.

The technical workflow involved a multi-stage fileless attack deploying the Havoc 'Demon' agent, followed by the installation of a Python-based keylogger. Notably, the attacker installed OpenSSH and Tailscale VPN as a backup persistence layer. This allowed the actor to regain access to compromised systems 18 days after their primary C2 infrastructure went offline, demonstrating that standard C2 takedowns are insufficient for full remediation when legitimate mesh-VPN services are abused for persistence.

The campaign highlights a growing trend of low-skill operators leveraging advanced persistence techniques that evade traditional file-based detection by using signed, legitimate binaries and encrypted tunnels.