Operation Poisson: Tailscale Install from Non-Standard Parent Correlated with DERP/ts.net Network Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects execution of the Tailscale or Tailscaled process that is not initiated by standard system or management processes. This may indicate unauthorized installation or use of the Tailscale VPN software for covert command and control or lateral movement, especially when combined with immediate network activity to Tailscale infrastructure or ports.