---
id: 7666
title: "BOFScale: A CDN-Fronted Tailnet from a BOF-PE"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe/"
published_at: "2026-08-19T00:00:00Z"
tags: ["red-team", "c2", "cdn", "tailscale", "evasion", "implant", "bof-pe"]
phying_url: "https://phying.com/item/7666"
lang: en
---

# BOFScale: A CDN-Fronted Tailnet from a BOF-PE

## Summary

BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2026-08-19T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/red-teaming/bofscale-a-cdn-fronted-tailnet-from-a-bof-pe/
- **Phying News:** https://phying.com/item/7666