BOFScale — running Tailscale in memory with CDN-fronted infrastructure
Tools2026-08-26, 13:50
BOFScale is a toolkit from NetSPI for creating a private, Tailscale-compatible network between a C2 implant and an operator workstation. Unlike standard Tailscale, its modified networking engine runs inside the implant process with no driver, no service, no disk state, and no child processes.
The server side is built on Headscale with an integrated DERP relay. BOFScale wraps DERP connections and the TS2021 control protocol in RFC 6455-compliant WebSockets, allowing Headscale and the DERP relay to be hosted behind CloudFront or Fastly.
It requires a C2 framework that supports BOF-PE and asynchronous tasks. The operator workstation should also use modified Tailscale components from the repository: the standard version does not support the CDN-based connection scheme implemented in BOFScale.
The C2 side uses 3 BOF-PE modules:
- tailscaled — a Tailscale background network daemon. It connects the implant to the private network, maintains connections with other nodes, and routes traffic. In BOFScale, the daemon runs as an asynchronous task inside the implant process
- tailscale — a control client for tailscaled. It is used to connect a node to the Headscale server, check network status, advertise routes to internal subnets, and run connection diagnostics
- socksportfwd — a port-forwarding tool. It accepts inbound TCP connections on the compromised node and forwards them to the operator workstation or another tailnet node through the SOCKS5 proxy built into tailscaled
Vendors
Products
More