A recent cybersecurity incident involved a French automotive business being compromised by an attacker known as "Poisson." This breach, characterized by the installation of a keylogger to steal sensitive banking and email information, took place over 33 days and was documented by Cato Networks.
On April 7, the attacker executed a five-hour session that solidified his access, even after his command-and-control server went offline. By employing tools such as OpenSSH and Tailscale, he established a backdoor that allowed persistent entry into the victim's system, illustrating that simply shutting down a C2 server is insufficient for complete remediation.
The operation was marked by numerous mistakes, including the attacker unintentionally exposing his home directory and leaving identifiable files in open storage. Despite these errors, he managed to compromise four machines, utilizing a series of techniques that involved memory-resident malware and manual credential collection. The analysis provided crucial insights into the vulnerabilities exploited during this intrusion.