In the world of cybersecurity, a recent incident involving a junior hacker has shed light on some clever tactics and the importance of comprehensive remediation. Let's dive into this intriguing story and explore its implications.
A Hacker's Tale
A French-speaking attacker, known by the handle "Poisson," targeted a small automotive business in France. The ordinary nature of this attack quickly took an interesting turn. Before his command-and-control (C2) server went offline, Poisson installed OpenSSH and Tailscale on a victim's machine, creating a backdoor that bypassed the C2 entirely. This move ensured his access remained intact even when the C2 server was down.
The Intrusion Unveiled
Researchers from Cato Networks captured the entire operation, providing a rare glimpse into the hacker's activities. They discovered that Poisson left his SSH keys and a detailed playbook in an open storage bucket, offering an unprecedented view of an intrusion from the operator's perspective.
Lessons Learned
The researchers' key takeaway is a stark reminder: pulling a C2 server offline is not sufficient remediation if the attacker has established alternative access routes. In this case, Poisson's use of OpenSSH and Tailscale created a separate door, allowing him to maintain access despite the C2's downtime.
The Operator's Profile
Poisson is described as a junior operator with a unique schedule. He seemed to operate on a school-like timetable, active after 3 p.m. CET with a long midday break. His choice of free-tier tools, such as DuckDNS and a cheap VPS, suggests a cost-conscious approach.
Technical Insights
The malware used by Poisson primarily resided in memory, with a VBScript stager and a PowerShell loader. He employed a non-silent UAC bypass, which required user interaction, and created a scheduled task with highest privileges for persistence. The keylogger, written in Python, captured keystrokes without exfiltration, and Poisson manually retrieved the data.
The Critical Move
On April 7, Poisson installed OpenSSH Server and Tailscale, joining the victim's machine to his private Tailscale network. This setup allowed him to access the machine over an encrypted mesh network without exposing any ports. The next day, when the Havoc infrastructure went offline, his access remained intact due to this alternative pathway.
The Aftermath
When the C2 server came back online on April 26, Poisson's agents automatically reconnected, and he continued his activities. He probed smart-card and certificate stores, suggesting an interest in certificate-based logins, and ran two unexplained executables from a file named "Thales.zip." He also deleted files before going quiet on May 1.
Tools and Techniques
Poisson's toolkit included well-known and legitimate tools, such as Tailscale and RustDesk. The binaries were signed, which could make detection challenging. His use of these tools highlights the importance of monitoring behavior rather than solely relying on file-based detection.
Implications and Takeaways
This incident underscores the need for a holistic approach to remediation. Simply taking down a C2 server may not be enough if the attacker has established other means of access. Organizations must hunt for quiet persistence layers and consider the entire attack chain.
What to Watch For
Cato Networks has provided a comprehensive list of indicators to watch for, including the installation of OpenSSH Server on Windows workstations, the presence of Tailscale on unexpected machines, reverse tunnels, and changes to power management settings. These indicators can help detect similar intrusion attempts.
Final Thoughts
The story of Poisson's intrusion serves as a reminder that cybersecurity is an ongoing battle. As attackers become more sophisticated, defenders must adapt and stay vigilant. By learning from incidents like these, we can strengthen our defenses and protect against future threats. It's a constant cat-and-mouse game, and staying ahead requires a deep understanding of both the tactics and the mindset of the attackers.
What do you think? Have you encountered similar challenges in your cybersecurity journey? Share your thoughts and experiences in the comments below!
