Operation Poisson: OpenSSH Server Installed on Windows as Backdoor

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.