USING TAILSCALE FOR PERSISTENCE

Summary from the TLDR InfoSec newsletter

This post details a method that uses Tailscale to establish a C2 on a Kubernetes node. In this scenario, an attacker has obtained time limited cluster-admin credentials and wants to utilize those credentials to establish persistence. The described attack involves deploying Tailscale on the node via containerd or a static manifest and utilizing Tailscale ACLs to only allow communication from C2 controller nodes to the infected bot nodes.