[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foEJtXi0XV_zdEMaY2TiUtvo9BnGuXrhA_fmzhoK4T_g":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"61671ef9-934a-4092-aa9c-ee0ce6895065","attacker-uses-tailscale-openssh-to-maintain-persistent-backdoor-beyond-c2-takedown","fb5bd582-9238-47e4-9cb7-a8b07e0b9e1c","Attacker Uses Tailscale & OpenSSH to Maintain Persistent Backdoor Beyond C2 Takedown","A junior threat actor installed legitimate remote access tools — OpenSSH and Tailscale — on a compromised machine before his command-and-control server went offline, creating a resilient backdoor that survived C2 disruption for 18 days. This highlights a growing tactic of 'living off the land' with trusted software to evade detection, since tools like Tailscale generate traffic that blends in with normal network activity. The root problem was a failure to monitor and control which software was installed on endpoints and what outbound network connections were being established. This matters because even if a primary malware payload is neutralised, secondary persistence mechanisms can give attackers indefinite re-entry. Organisations that focus solely on malware signatures will miss attacker-installed legitimate tools used as backdoors.","**Immediate actions:**\n- Audit all endpoints for unauthorised installations of remote access tools such as Tailscale, AnyDesk, ngrok, and OpenSSH.\n- Block or alert on outbound connections to Tailscale coordination servers and other peer-to-peer VPN infrastructure at the perimeter firewall.\n- Force a credential reset and revoke active sessions on any machine suspected of compromise.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tooling configured to alert on installation of new network tunnelling or remote access software.\n- Monitor for unexpected SSH daemon processes or new listening ports appearing on workstations and servers.\n- Centralise and review logs for unusual outbound traffic patterns, particularly to cloud-hosted coordination endpoints.\n\n**Long-term improvements:**\n- Implement application whitelisting policies that prevent unauthorised software installation by non-administrative users.\n- Enforce network segmentation so that compromised endpoints cannot initiate arbitrary outbound connections to the internet.\n- Establish a formal incident response playbook that includes hunting for secondary persistence mechanisms before declaring an incident closed.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 IR-4: Incident Handling","MITRE ATT&CK T1572: Protocol Tunneling","MITRE ATT&CK T1021.004: Remote Services — SSH","MITRE ATT&CK T1133: External Remote Services",{},"published","2026-06-17T18:20:40.154293+00:00","2026-06-17T18:20:40.086+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fjunior-hacker-used-tailscale-and.html","junior-hacker-used-tailscale-and-openssh-to-keep-access-after-his-c2-went-offlin-538b5a","Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[51,55,59],{"slug":52,"name":53,"problem":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]