Procedure examples

Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.

Threat Group-3390 has registered domains for C2.

TeamPCP has registered domains resembling legitimate victim sites such as scan.aquasecurtiy[.]org, checkmarx[.]zone, and git-tanstack[.]com to mask C2 and exfiltration endpoints. TeamPCP has also set up a dark web leak site to post stolen data.

ShinyHunters has established clearnet and Tor data leak sites (DLS) including one named “SHINYHUNTERS” for the exfiltration and posting of stolen data. Additionally, ShinyHunters has registered domains that mimic legitimate Microsoft Azure NetApp Files endpoints, such as azurenetfiles[.]net, and legitimate Okta SSO login pages, such as trial-6857053.okta[.]com.

Sea Turtle built adversary-in-the-middle DNS servers to impersonate legitimate services that were later used to capture credentials.

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.

HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.

BlackByte staged encryption keys on virtual private servers operated by the adversary.

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.

CURIUM created virtual private server instances to facilitate use of malicious domains and other items.

Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.

Sea Turtle created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture.

Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.

Axiom has used VPS hosting providers in targeting of intended victims.

Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.

APT28 hosted phishing domains on free services for brief periods of time during campaigns.

APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.

LAPSUS$ has used VPS hosting providers for infrastructure.

Moonstone Sleet registered virtual private servers to host payloads for download.

VOID MANTICORE has utilized VPS solutions for C2.

GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.

Mustard Tempest has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.

CURIUM has created dedicated servers for command and control and exfiltration purposes.

Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.

VOID MANTICORE has leveraged backend servers within Iran.

TeamPCP has leased infrastructure specifically for offensive operations including Google assets in AS396982.

ShinyHunters has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.

HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.

Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.

APT5 has acquired a network of compromised systems – specifically an ORB (operational relay box) network – for follow on activities.

APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot. Kimsuky has also leveraged Dropbox for hosting payloads and uploading victim system information.

APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.

HAFNIUM has acquired web services for use in C2 and exfiltration.

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.

FIN7 has set up Amazon S3 buckets to host trojanized digital products.

Mustang Panda has set up Dropbox and Google Drive to host malicious downloads.

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.

Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.

Confucius has obtained cloud storage service accounts to host stolen data.

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.