Tailscale and OpenSSH Became a Junior Operator's Back Door After His Havoc C2 Went Dark

An intrusion at a small French automotive business is worth reading closely, not for the sophistication, but for what it reveals about residual access after a command-and-control server goes offline.

The operator was, by all appearances, a junior. French-speaking. Working from a Havoc C2. The initial activity was unremarkable: a keylogger, harvested banking credentials, harvested email credentials. The kind of intrusion that fills incident response queues every week.

Then came the part that matters for defenders and, eventually, for regulators.

Before the Havoc infrastructure went dark, the attacker installed two legitimate tools on a victim endpoint. OpenSSH and Tailscale. Both are signed. Both are widely used. Neither typically trips an EDR rule on its own. Together, they constitute a parallel access channel that does not depend on the C2 at all.

When the Havoc server went offline the following day, the operator still had a way back in.

This matters for disclosure timing. Under the SEC's final cybersecurity disclosure rule at 17 CFR 229.106 (Item 1.05 of Form 8-K), the four-business-day clock starts when an incident is determined to be material, not when the obvious malware is evicted. An organization that scopes an intrusion to the Havoc beacon and calls it contained may discover, weeks later, that a Tailscale tailnet membership and an SSH daemon on a finance workstation extended the incident window materially. The materiality determination then arguably resets.

The same scoping problem hits CIRCIA reporting once CISA's final rule lands. The proposed rule, published April 4, 2024 at 89 Fed. Reg. 23644, defines a covered cyber incident broadly enough that persistent unauthorized access through a legitimate remote-administration tool would qualify. Comments closed July 3, 2024. The final rule is not yet published.

In the EU, NIS2 Article 23's 24-hour early warning and 72-hour incident notification obligations apply per Member State transposition. Operators relying on a narrow read of "the incident" will find national CSIRTs uninterested in that distinction.

A few practical takeaways for counsel and detection engineers reading the same facts.

Inventory Tailscale. The control plane is centralized; an enterprise can query which devices hold auth keys and which tailnets they joined. Unmanaged installs on corporate endpoints should be treated as indicators, not shadow IT.

Alert on OpenSSH server installation on Windows endpoints that have no operational reason to run sshd. The Windows port is legitimate and signed by Microsoft, which is precisely why it works for this purpose.

And write incident scoping procedures that explicitly ask whether any legitimate remote-access tooling was introduced during the dwell time. If the answer is yes, the containment date is not the date the beacon died.

The junior operator's trick was not clever. It was cheap, and it was effective. Regulators will not grade on difficulty.