{"id":1173,"date":"2026-08-20T11:07:43","date_gmt":"2026-08-20T05:37:43","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1173"},"modified":"2026-08-20T11:09:42","modified_gmt":"2026-08-20T05:39:42","slug":"tailscale-openssh-persistence-after-c2-outage","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/tailscale-openssh-persistence-after-c2-outage\/","title":{"rendered":"Tailscale Persistence & OpenSSH Maintain Access After C2 Outage"},"content":{"rendered":"

A recent Cato Networks investigation highlights a challenge many security teams continue to underestimate: removing malware infrastructure does not necessarily remove attacker access. The case also demonstrates how Tailscale persistence can help attackers maintain connectivity even after their primary command-and-control infrastructure is disrupted.<\/p>\n

In the reported intrusion, the attacker maintained access to the environment even after their primary command-and-control (C2) channel became unavailable. Instead of relying solely on custom malware, they established alternative access paths using legitimate remote administration technologies, allowing persistence beyond the lifespan of the original attack infrastructure.<\/p>\n

For enterprise defenders, this reinforces an important reality. Modern incident response cannot stop at disrupting malware communications or blocking known indicators of compromise. Security teams must also identify and eliminate unauthorized remote access mechanisms, persistence techniques, and trusted administrative tools that attackers may have deployed to survive remediation efforts.<\/p>\n

The incident serves as a reminder that attackers do not always need sophisticated malware to remain inside a network. In many cases, legitimate tools and services can provide a more resilient and less conspicuous foothold than traditional command-and-control frameworks.<\/p>\n

Breaking Down the Multi-Stage Intrusion<\/h2>\n

The attack followed a multi-stage execution chain designed to minimize detection and maintain flexibility throughout the intrusion. According to Cato Networks’ analysis, the infection began with a VBScript-based stager that launched PowerShell components, which then delivered a .NET loader responsible for deploying the Havoc Demon implant. Much of the malicious activity operated in memory, reducing the forensic artifacts typically associated with disk-based malware.<\/p>\n

Once execution was established, the attacker focused on persistence and privilege escalation. The investigation observed attempts to elevate privileges using Windows’ Start-Process -Verb RunAs<\/code> functionality, followed by the creation of scheduled tasks configured to run with the highest available privileges at user logon.<\/p>\n

Additional persistence and evasion mechanisms included:<\/p>\n