Real-world descriptions of how a group, tool or campaign used a technique.
16 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1583.003 Virtual Private Server |
GroupBlackByte | BlackByte staged encryption keys on virtual private servers operated by the adversary. |
| T1583.003 Virtual Private Server |
GroupDragonfly | Dragonfly has acquired VPS infrastructure for use in malicious campaigns. |
| T1583.003 Virtual Private Server |
GroupHAFNIUM | HAFNIUM has operated from leased virtual private servers (VPS) in the United States. |
| T1583.003 Virtual Private Server |
GroupGamaredon Group | Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia. |
| T1583.003 Virtual Private Server |
GroupCURIUM | CURIUM created virtual private server instances to facilitate use of malicious domains and other items. |
| T1583.003 Virtual Private Server |
GroupContagious Interview | Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud. |
| T1583.003 Virtual Private Server |
GroupSea Turtle | Sea Turtle created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture. |
| T1583.003 Virtual Private Server |
GroupWinter Vivern | Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications. |
| T1583.003 Virtual Private Server |
GroupAxiom | Axiom has used VPS hosting providers in targeting of intended victims. |
| T1583.003 Virtual Private Server |
GroupEmber Bear | Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration. |
| T1583.003 Virtual Private Server |
GroupAPT28 | APT28 hosted phishing domains on free services for brief periods of time during campaigns. |
| T1583.003 Virtual Private Server |
GroupAPT42 | APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment. |
| T1583.003 Virtual Private Server |
GroupAPT-C-36 | APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure. |
| T1583.003 Virtual Private Server |
GroupLAPSUS$ | LAPSUS$ has used VPS hosting providers for infrastructure. |
| T1583.003 Virtual Private Server |
GroupMoonstone Sleet | Moonstone Sleet registered virtual private servers to host payloads for download. |
| T1583.003 Virtual Private Server |
GroupVOID MANTICORE | VOID MANTICORE has utilized VPS solutions for C2. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
