When C2 Dies, Persistent Access Lives: Tailscale and OpenSSH in Supply Chain Attacks

In a recent incident reported by The Hacker News, a junior-level attacker demonstrated how easily persistent access can outlive command-and-control infrastructure. After their primary C2 server went offline, the attacker pivoted to Tailscale and OpenSSH to maintain a foothold in the compromised environment. This case is a stark reminder that supply chain attacks don't end when the initial payload fails—they evolve.

How the Attack Works

The attack follows a classic supply chain pattern with a modern twist. The initial compromise likely occurred through a trusted dependency or vendor access point, giving the attacker legitimate-appearing credentials or code execution within the target environment. Once inside, the attacker deployed Tailscale—a legitimate mesh VPN tool—to create an encrypted, peer-to-peer tunnel that bypasses traditional network perimeter controls.

When the primary C2 infrastructure became unreachable, the attacker didn't lose access. Instead, they relied on OpenSSH over the Tailscale network to continue operating. This is significant because many detection systems focus on outbound C2 beacons to known-bad infrastructure. A Tailscale+SSH combination uses infrastructure the victim may already trust, making it appear as normal administrative activity.

The supply chain angle matters here: attackers are increasingly abusing tools already present in development and deployment pipelines. If your CI/CD runners, build agents, or AI agent hosts have Tailscale installed for legitimate remote access, that same capability becomes an attacker's persistence mechanism.

Why This Threatens AI Agent Deployments

AI agents introduce unique persistence risks. Unlike traditional servers with fixed purposes, agents often run with broad permissions, access multiple APIs, and execute dynamic tool chains. If an attacker establishes SSH access through a hidden Tailscale node, they can observe agent behavior, inject malicious tool calls, or silently exfiltrate outputs.

The real danger is trust decay. An AI agent's security model depends on knowing which tools, endpoints, and credentials are legitimate. A persistent attacker can manipulate that trust boundary over time—poisoning tool outputs, altering agent configuration, or redirecting API calls to compromised endpoints. Because agents operate semi-autonomously, these manipulations may not trigger immediate human review.

Detection and Prevention Strategies

Defending against this pattern requires visibility into both network identity and process behavior. Here are concrete measures AI agent operators should implement:

Audit Mesh VPN Membership

Review all devices enrolled in your Tailscale (or similar) network. Any unauthorized or unexpected nodes should trigger immediate investigation:

# List all Tailscale devices and their auth keys
tailscale status --json | jq '.Peer[] | {Hostname, UserID, OS}'

# Check for recently added nodes
tailscale status --json | jq '.Peer[] | select(.Online) | {Hostname, LastSeen}'

Restrict SSH Access with Host-Level Controls

Assume any host running AI agents is a high-value target. Harden SSH with certificate-based authentication, disable password logins, and enforce access via bastion hosts:

# /etc/ssh/sshd_config hardening for AI agent hosts
PasswordAuthentication no
PermitRootLogin no
AllowUsers deploy@10.0.0.* agent-operator@10.0.0.*
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 0

Monitor for Unauthorized Tunneling Tools

Use endpoint detection or periodic audits to flag unexpected installations of mesh VPN clients, reverse proxies, or SOCKS tunnels:

# Quick audit for common tunneling tools on Linux hosts
find /usr/bin /usr/local/bin -type f \( \
  -name "tailscale" -o -name "ngrok" -o -name "frpc" -o -name "cloudflared" \
\) 2>/dev/null

Implement Network Segmentation for Agent Hosts

AI agents should run in isolated network segments with egress filtering. If an agent host doesn't need Tailscale for its function, remove it. If it does need remote access, restrict the Tailscale ACL so the host can only reach specific control plane endpoints—not the open internet.

Immediate Actions for Operators

1. Inventory your Tailscale network today. Unknown nodes are a red flag.
2. Review SSH authorized_keys and known_hosts on every host running AI agents.
3. Enable process and network auditing with tools like auditd or eBPF monitors to capture unexpected SSH or VPN activity.
4. Validate your supply chain dependencies. If your agent deployment includes remote access tools, treat them as part of your attack surface.
5. Test your incident response. Simulate a C2 failure and verify whether your controls would catch alternative persistence channels.

Key Takeaways

Persistent access doesn't require sophisticated tooling—just creativity and the abuse of legitimate infrastructure. The incident outlined in the original Hacker News report shows that even junior attackers can maintain long-term compromise by blending into normal administrative patterns. For AI agent operators, the lesson is clear: your security model must account for the tools already present in your environment, not just the ones attackers bring with them.

Trust your tools, but verify their configuration. The difference between legitimate remote access and an attacker's lifeline is often a single misconfigured ACL or an unaudited authorized key.