Tailscale and OpenSSH Became a Junior Operator's Back Door After His Havoc C2 Went Dark

Key points

• A French-speaking attacker broke into a small French automotive business, stole banking and email credentials, then installed OpenSSH and Tailscale before his Havoc command-and-control server went offline.
• Both tools are signed and widely trusted, so neither typically triggers an endpoint detection rule on its own.
• When the Havoc server went dark the following day, the operator still had a working path back in.
• Scoping an intrusion to the beacon and declaring it contained is the mistake regulators and national CSIRTs will not forgive.
• Incident-response teams should treat any legitimate remote-access tool installed during dwell time as a containment-date problem, not shadow IT.

What actually happened

A French-speaking attacker, apparently junior-level, hit a small French automotive business with a keylogger and harvested banking and email credentials. Ordinary incident-response work. The part worth dissecting came just before his Havoc command-and-control infrastructure went offline: he installed OpenSSH and Tailscale on a victim endpoint, building a return path that didn't depend on the C2 at all. When the Havoc server died the next day, he still had the keys.

We first tracked OpenSSH being turned against defenders on 12 June 2026, when Velvet Ant spent nearly a decade inside PAM and OpenSSH on Linux hosts IR runbooks rarely reach. That was a sophisticated, long-running crew. This is a junior operator with commodity tools. The technique doesn't require sophistication; it requires knowing that signed binaries don't get a second look.

Should you worry about the disclosure clock

Yes, and here's why the timing matters. Under the SEC's cybersecurity disclosure rule, the four-business-day reporting clock starts when an incident is determined to be material, not when the obvious malware is evicted. An organization that scopes its investigation to the Havoc beacon and calls it contained may find, weeks later, that a Tailscale tailnet membership and an SSH daemon on a finance workstation extended the incident window. That finding arguably resets the materiality determination.

CIRCIA reporting will carry the same risk once CISA's final rule publishes. The proposed rule defines a covered cyber incident broadly enough that persistent unauthorized access through a legitimate remote-administration tool would qualify. The final rule hadn't published as of this story.

In the EU, NIS2 imposes early-warning and incident-notification deadlines per Member State transposition. Operators who lean on a narrow read of "the incident" will find national CSIRTs unwilling to accept that framing.

What detection engineers should do now

Inventory Tailscale. Its control plane is centralized, so an enterprise can query which devices hold auth keys and which tailnets they've joined. Unmanaged installs on corporate endpoints are indicators, not just policy violations.

Alert on OpenSSH server installation on Windows endpoints with no operational reason to run sshd. The Windows port is legitimate and signed, which is precisely what makes it useful for this purpose.

Write incident-scoping checklists that explicitly ask whether any legitimate remote-access tooling appeared during dwell time. If the answer is yes, the containment date isn't the day the beacon died.

The operator's move wasn't clever. It was cheap, and it worked. Regulators won't grade on difficulty.