The 'Operation Poisson' campaign represents a targeted credential theft operation conducted by a French-speaking threat actor nicknamed 'Poisson' against the French automotive sector. This sophisticated campaign, observed over 33 days with 339 executed commands, targets small-to-medium automotive businesses and individuals in France. The adversary employs a multi-stage fileless attack chain that deploys a custom 70-line Python keylogger designed specifically to harvest banking and email credentials.
Notably, the operation leverages free-tier infrastructure to maintain a low operational cost and reduce attribution risk, including the Havoc C2 framework, Tailscale for network tunneling, and RustDesk for remote access. This cost-effective approach demonstrates the democratization of cybercrime capabilities, where even low-budget actors can execute sophisticated credential theft operations.
Threat Actor / Malware Profile
Threat Actor: Poisson
- Origin: French-speaking
- Tactics: Command-line heavy operations (339 commands in 33 days)
- Targeting: Automotive industry and French individuals
- Objective: Credential harvesting (banking and email)
- Infrastructure: Free-tier services to minimize costs
Malware Families:
Havoc C2 Framework (S1229)
- Type: Post-exploitation Command & Control framework
- Distribution: Delivered via fileless attack chains
- C2 Communication: Custom protocol with encrypted traffic
- Persistence: Registry run keys and scheduled tasks
- Anti-Analysis: Uses process hollowing and encrypted payloads
Python Keylogger (Custom 70-line script)
- Type: Credential harvester
- Behavior: Captures keystrokes targeting banking and email credentials
- Execution: In-memory via Python interpreter, often fileless
- Exfiltration: Encrypted HTTP/HTTPS traffic to C2 servers
- Persistence: Scheduled task or registry modification
RustDesk
- Type: Legitimate remote desktop software weaponized for C2
- Abuse: Used for remote access and data exfiltration
- Detection Challenge: Legitimate software making detection difficult
IOC Analysis
The indicators provided in this pulse include:
- Domain: wawsenti.duckdns.org - A Dynamic DNS hostname used for C2 infrastructure
- File Hashes: 8 SHA256 hashes likely representing components of the attack chain
SOC Operationalization:
- Block the DuckDNS domain at perimeter defenses (firewall, DNS resolver)
- Add file hashes to endpoint detection (EDR) and antivirus signatures
- Configure SIEM alerts for network connections to DuckDNS domains
- Deploy YARA rules to scan endpoints for Python keyloggers matching provided hashes
- Use threat intelligence platforms (MISP, Anomali) to automatically ingest these IOCs
Tooling Recommendations:
- VirusTotal for hash analysis
- CrowdStrike Falcon for fileless malware detection
- Palo Alto Cortex XDR for behavioral analysis
- Microsoft Defender for Endpoint for registry and process monitoring
Detection Engineering
YAML
---
title: Python Keylogger Execution via Fileless Method
id: d2a3b8c1-e5f4-4a6b-9c1d-8e7f6a5b4c3d
description: Detects execution of Python scripts potentially acting as keyloggers, particularly when run from fileless sources or unusual locations
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
- https://www.catonetworks.com/blog/cato-ctrl-operation-poisson-analyzing-a-cybercriminals-entire-operation/
tags:
- attack.credential_access
- attack.t1056.001 # Keylogging
- attack.t1059.006 # Python execution
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\\python.exe'
- '\\python3.exe'
CommandLine|contains:
- '-c '
- 'import keylogger'
- 'import pynput'
- 'keyboard.record'
condition: selection
falsepositives:
- Legitimate Python development
level: high
---
title: Havoc C2 Framework Network Traffic
id: c8b7d6e5-f4a3-4b6c-a1d2-9e8f7a6b5c4d
description: Detects potential network traffic related to Havoc C2 framework, including DuckDNS domains and encrypted C2 patterns
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
- https://www.catonetworks.com/blog/cato-ctrl-operation-poisson-analyzing-a-cybercriminals-entire-operation/
tags:
- attack.command_and_control
- attack.c2
- attack.t1071.001 # Web Protocols
- attack.s1229 # Havoc C2
logsource:
category: network_connection\ product: windows
detection:
selection_domain:
DestinationHostname|endswith:
- '.duckdns.org'
selection_pattern:
DestinationPort:
- 80
- 443
- 8888
DestinationPortCount:
- 1
selection_ua:
UserAgent|contains:
- 'Havoc'
- 'Python-urllib'
- 'python-requests'
condition: 1 of selection*
falsepositives:
- Legitimate use of DuckDNS for personal services
- Python-based applications
level: high
---
title: RustDesk Remote Access for C2 Purposes
id: e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b
description: Detects potential abuse of RustDesk remote desktop software for C2 operations, particularly when connecting to non-standard infrastructure
status: experimental
date: 2026/07/19
author: Security Arsenal
references:
- https://www.catonetworks.com/blog/cato-ctrl-operation-poisson-analyzing-a-cybercriminals-entire-operation/
tags:
- attack.command_and_control
- attack.t1219 # Remote Access Software
- attack.s0156 # RustDesk
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- '\
ustdesk.exe'
- '\
ustdesk--.exe'
selection_network:
DestinationHostname|contains:
- 'duckdns.org'
- 'no-ip.org'
- 'ngrok.io'
selection_params:
CommandLine|contains:
- '--connect'
- '--server'
condition: selection_process and 1 of selection*
falsepositives:
- Legitimate remote support using RustDesk
level: medium
kql
// Hunt for connections to DuckDNS domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl contains \"duckdns.org\"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc
// Hunt for Python script execution with suspicious arguments
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ (\"python.exe\", \"python3.exe\")
| where ProcessCommandLine contains \"-c \" or ProcessCommandLine contains \"import keylogger\" or ProcessCommandLine contains \"keyboard.record\"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
// Hunt for fileless execution patterns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains \"powershell -c\" or ProcessCommandLine contains \"python -c\"
| where InitiatingProcessFileName in~ (\"cmd.exe\", \"powershell.exe\", \"wscript.exe\", \"cscript.exe\")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ParentProcessFileName
| order by Timestamp desc
// Hunt for potential Havoc C2 persistence mechanisms
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey contains @\"\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\"
| where RegistryValueData contains \"python\" or RegistryValueData contains \"havoc\"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
| order by Timestamp desc
powershell
# PowerShell Hunt Script for Operation Poisson IOCs
# Author: Security Arsenal
# Purpose: Hunt for indicators related to Operation Poisson campaign
# File Hashes to check
$maliciousHashes = @(
\"0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe\",
\"1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6\",
\"291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195\",
\"3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60\",
\"aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31\",
\"c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7\",
\"f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45\"
)
# DuckDNS domain to check
$duckDNSDomain = \"wawsenti.duckdns.org\"
# Check for files with malicious hashes
Write-Host \"Scanning for files matching malicious hashes...\" -ForegroundColor Yellow
$commonPaths = @(
\"$env:TEMP\",
\"$env:APPDATA\",
\"$env:USERPROFILE\\Downloads\",
\"$env:USERPROFILE\\Desktop\",
\"C:\\ProgramData\",
\"C:\\Windows\\Temp\"
)
foreach ($path in $commonPaths) {
if (Test-Path $path) {
Write-Host \"Scanning $path...\" -ForegroundColor Gray
Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue |
ForEach-Object {
$hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($hash -in $maliciousHashes) {
Write-Host \"MALICIOUS FILE DETECTED: $($_.FullName)\" -ForegroundColor Red
Write-Host \"SHA256: $hash\" -ForegroundColor Red
}
}
}
}
# Check DNS cache for DuckDNS domain
Write-Host \"Checking DNS cache for $duckDNSDomain...\" -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue |
Where-Object { $_.Entry -like \"*$duckDNSDomain*\" }
if ($dnsCache) {
Write-Host \"POTENTIAL C2 COMMUNICATION DETECTED: $duckDNSDomain\" -ForegroundColor Red
$dnsCache | Format-Table Entry, Data, Type, TimeToLive -AutoSize
}
# Check for persistent Python processes
Write-Host \"Checking for persistent Python processes...\" -ForegroundColor Yellow
$pythonProcesses = Get-Process -Name \"python*\" -ErrorAction SilentlyContinue
if ($pythonProcesses) {
foreach ($proc in $pythonProcesses) {
Write-Host \"Python process detected: PID $($proc.Id), Path: $($proc.Path)\" -ForegroundColor Cyan
Get-WmiObject Win32_Process -Filter \"ProcessId=$($proc.Id)\" |
Select-Object ProcessId, CommandLine, ParentProcessId | Format-List
}
}
# Check for RustDesk installations
Write-Host \"Checking for RustDesk installations...\" -ForegroundColor Yellow
$rustdeskPath = \"$env:APPDATA\\RustDesk\"
if (Test-Path $rustdeskPath) {
Write-Host \"POTENTIAL C2 TOOL DETECTED: RustDesk installation found at $rustdeskPath\" -ForegroundColor Yellow
Get-ChildItem -Path $rustdeskPath -Recurse -ErrorAction SilentlyContinue | Format-Table FullName, LastWriteTime
}
# Check for suspicious scheduled tasks
Write-Host \"Checking for suspicious scheduled tasks...\" -ForegroundColor Yellow
$suspiciousTasks = Get-ScheduledTask |
Where-Object { $_.Actions.Execute -like \"*python*\" -or $_.TaskName -like \"*update*\" } |
Where-Object { $_.Author -notlike \"*Microsoft*\" }
if ($suspiciousTasks) {
Write-Host \"POTENTIAL PERSISTENCE DETECTED: Suspicious scheduled tasks found\" -ForegroundColor Yellow
$suspiciousTasks | Format-List TaskName, Author, Actions, Triggers, LastRunTime
}
Write-Host \"Hunt completed.\" -ForegroundColor Green
Response Priorities
Immediate Actions:
- Block all IOCs at perimeter defenses (firewall, DNS resolver, proxy)
- Deploy the provided Sigma rules to SIEM and EDR platforms
- Run the PowerShell hunt script across all endpoints
- Initiate a hunt for Python processes with command-line arguments matching the keylogger behavior
- Quarantine any systems matching the provided file hashes
24 Hours:
- Conduct identity verification for all accounts potentially accessed from affected systems
- Force password resets for banking and email accounts accessed from compromised endpoints
- Review authentication logs for suspicious activity from the targeted period
- Enable multi-factor authentication for all critical accounts
- Conduct a thorough review of network logs for connections to DuckDNS domains
1 Week:
- Implement application allowlisting to prevent unauthorized Python execution
- Harden systems against fileless attack techniques (PowerShell, WMI, etc.)
- Deploy network monitoring to detect usage of remote access tools like RustDesk
- Conduct threat hunting for other potential Havoc C2 infections
- Review and update remote access policies to prevent abuse of legitimate tools
- Implement DNS sinkholing for dynamic DNS services not required for business operations
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
darkwebotx-pulsedarkweb-credentialshavoc-c2credential-theftautomotive-sectorfileless-attackrustdesk
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.