Operation Poisson involved 339 commands over 33 days by a French-speaking adversary targeting French victims. The attacker employed a fileless multi-stage attack deploying a 70-line Python keylogger to harvest credentials. The infrastructure used included Havoc C2 framework, Backblaze B2 cloud storage, and DuckDNS domains. Crucially, the attacker installed OpenSSH and Tailscale VPN to create a persistent VPN mesh network on compromised hosts, maintaining access even after the C2 infrastructure was taken offline for an extended period. This demonstrates real-world use of VPN mesh persistence techniques that evade traditional remediation efforts focused on C2 takedown.

The attacker successfully harvested banking and email credentials from targeted victims. The use of OpenSSH and Tailscale VPN for persistence allowed the attacker to maintain long-term access despite C2 server takedown, increasing the difficulty of fully remediating the intrusion. This persistence mechanism enables stealthy and resilient control over victim machines, potentially facilitating ongoing data theft or further malicious activity.

No official patch or fix is applicable as this is an attack campaign rather than a software vulnerability. Remediation requires thorough incident response including detection and removal of OpenSSH and Tailscale VPN installations used for persistence. Traditional C2 takedown alone is insufficient; defenders must identify and disrupt VPN mesh connections and other persistence mechanisms on compromised hosts. Monitoring for indicators of compromise such as the provided IPs, domains, and file hashes can aid detection.