Loading story…
Cato Networks detailed a 33-day intrusion by a French-speaking threat actor tracked as Poisson that targeted a small French automotive business and several French individuals, using 339 recorded commands recovered from an exposed Havoc command-and-control server. The attacker used a multi-stage fileless infection chain, scheduled-task persistence, Explorer.exe injection, a custom RustDesk deployment, and a simple Python keylogger to steal banking, email, and other credentials, while also enumerating certificate stores and manually collecting keystroke logs.
The most consequential step came when Poisson installed OpenSSH Server and Tailscale on a victim machine, configured key-based SSH and a reverse tunnel, and created a VPN-mesh-backed access path that remained active after the Havoc C2 went offline. When the infrastructure returned, the implants reconnected without the attacker needing to re-compromise the victims, showing how even a relatively low-skill operator using inexpensive services such as DuckDNS, Backblaze B2, and an IONOS VPS could preserve post-compromise access and continue credential-focused activity despite a C2 disruption.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
On June 16, 2026, Cato Networks published its analysis of Operation Poisson, detailing the actor's tooling, persistence methods, and the resilience provided by Tailscale and OpenSSH after the C2 outage. The report was based on 33 days of exposed command history from the actor's Havoc server.
Cato's observed 33-day command history from the Poisson operation ran through May 1, 2026. The captured dataset covered the actor's activity across the intrusion window from March 30 to May 1.
On April 26, 2026, the Havoc C2 infrastructure came back online and the implants reconnected automatically without the attacker needing to re-compromise victims. The actor then resumed credential-focused activity.
Beginning April 8, 2026, the Havoc command-and-control infrastructure went offline. Despite the outage, the attacker retained access through the previously established OpenSSH and Tailscale persistence.
On April 7, 2026, the attacker installed OpenSSH Server and Tailscale on a victim machine, configuring SSH access and a separate VPN-mesh-based persistence path. This created resilient access outside the primary Havoc C2 channel.
A French-speaking threat actor tracked as "Poisson" began a 33-day operation on March 30, 2026, targeting a small French automotive business and several French individuals. Cato later documented 339 commands from the actor's Havoc C2 activity during this period.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecatonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an ongoing Linux server compromise campaign in which attackers exploit **Control Web Panel (CWP)** to install a malware package known as **Facefish**, an `LD_PRELOAD`-based userland rootkit that backdoors **OpenSSH**. The intrusion chain retrieves an installer often named `sshins`, downloads a first-stage payload from `176.111.174.26`, drops a malicious shared library as `/lib64/libs.so`, adds it to `/etc/ld.so.preload`, restarts `sshd`, and then removes evidence from CWP logs and shell history. The malware primarily targets x64 Linux systems and has also shown the ability to adapt to FreeBSD environments. Once active, the backdoor hooks OpenSSH-related functions to steal SSH credentials, collect host information, and provide remote access through arbitrary command execution and reverse shell capabilities. Researchers said the malware beacons to `176.111.174.26:443` over raw TCP and protects communications with negotiated keys and **Blowfish**-encrypted traffic, using techniques that hinder straightforward network detection. The samples also employ anti-analysis measures including UPX packing, erased ELF sections, and randomized rootkit encryption keys, while analysts assessed the operators were likely harvesting access and system intelligence for later monetization rather than immediately deploying follow-on payloads such as cryptominers.
Aug 15, 2026
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked **OilRig** tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to `srvr.js`, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that **Turla** had previously hijacked OilRig infrastructure. A separate assessment of the **SolarWinds Orion** breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including **DHS**, **FireEye**, and the **U.S. Treasury**, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and **Cobalt Strike** deployment.
Jun 29, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026