FORENSIA

ATT&CK · T1583.003 · sub-technique

Virtual Private Server

Tactics: resource-development

About

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.

Corpus indicators tagged with this technique

23 indicators in the corpus carry T1583.003.

IndicatorTypeFamilySevSrc
52fda5c1b9704544f32ee98d9060e689hashransomware802
51d39aa39478beeac94f2d12f682eccehashransomware802
144.208.127.155ipransomware701
38.54.88.201ipransomware701
45.61.136.173ipransomware701
38.54.107.167ipransomware701
45.225.135.54ip702
209.182.225.136ipransomware701
38.60.157.139ipransomware701
162.33.177.101ipransomware701
203.237.119.147ip702
platform.exathomeswebuyarizona.comdomainransomware651
app-front.anmaradigital.comdomainransomware651
content.garretttrails.orgdomainransomware651
trademark.iglesiaelarca.comdomainransomware651
promo.summat10n.orgdomainransomware651
billing.roofnrack.usdomainransomware651
devel.asurans.comdomainransomware651
storehouse.beautysupplysalonllc.comdomainransomware651
samples.addisgraphix.comdomainransomware651
api-app.uppercrafteroom.comdomainransomware651
pa-portal.benningtonspringsmhp.comdomainransomware651
shop.steadycompanion.comdomainransomware651