A French-speaking attacker, nicknamed “Poisson,” hacked a small French automotive business, planted a simple Python keylogger, and stole banking and email credentials. The intrusion used an in-memory Havoc Demon implant chain launched via VBScript and PowerShell, persistence through a high-privilege scheduled task and shellcode in Explorer.exe, plus a custom RustDesk backup channel. Poisson installed later installed OpenSSH Server and Tailscale, joined the victim machine to his private Tailscale network, and set up key-based SSH with a reverse tunnel. When his Havoc command-and-control (C2) server went offline, Tailscale access remained allowing agents to reconnect automatically eighteen (18) days later when C2 returned back online. Despite sloppy tradecraft such as leaking his home directory, naming buckets after his handle, and failing many other actions, he still compromised four (4) machines. CTIX Analysts recommend organizations and defenders to hunt for quiet persistence like OpenSSH, Tailscale, suspicious scheduled tasks, and powercfg changes rather than assuming killing C2 equals remediation. Attackers can still use legitimate, signed tools to outlive C2 takedowns.