Procedure examples

Indrik Spider has served fake updates via legitimate websites that have been compromised.

Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.

Dragonfly has compromised legitimate websites to host C2 and malware modules.

Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.

Leviathan has used compromised legitimate websites as command and control nodes for operations.

Turla has used compromised servers as infrastructure.

Lazarus Group has compromised servers to stage malicious tools.

Earth Lusca has used compromised web servers as part of their operational infrastructure.

APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.

Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.