Forensia CTI Core

About

Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.

Platforms: PREParent: T1584 Compromise InfrastructureMITRE ATT&CK ↗

Used by actors

10 known groups

G0010 Turla G0023 APT16 G0032 Lazarus Group G0034 Sandworm Team G0035 Dragonfly G0065 Leviathan G0119 Indrik Spider G1006 Earth Lusca G1017 Volt Typhoon G1034 Daggerfly

Software

0 malware/tools implement this

None mapped.

Corpus indicators tagged with this technique

151 indicators in the corpus carry T1584.004.

Indicator	Type	Family	Sev	Src
415b253a81e67c8c860a97c73edc9017ce732b3c025d943d3b1a445b4ac82822	sha256	—	80	1
6c428acbd91be85fedf9cbb334457ddea08ff624d4de88041749578e968d62a8	hash	phishing	80	3
dfa9c6adac98311d0f62e0eeecb947d92f7bda41ddf4ce9a6f9e20af7990422d	sha256	—	80	1
13ac78f8f2ed76a03c85f0cdef07e5463aa64458303c0949090fcd81868ba8ca	hash	phishing	80	3
c5ec55270af084d3c07d2918098d598bc2c5ca42f4189d69cdfcae2c958e5ec7	hash	phishing	80	3
33d887ca2e57fa03fc807dfba5376bf96718ee88f56e90d95ee4896a2c019bd0	sha256	—	80	1
95cda8431419f77407484ab72dc1e356421dcd801eccabe8869f77ee0eb58eb2	sha256	—	80	1
5d2ad1795b0dfc4a58424b2fa2f002246f653b119d362954ae270b6998e9d575	hash	phishing	80	3
5aa7afd790481ad98357636fa4d9927ae01111409c8d7ce69998d2485c1d5e6f	sha256	—	80	1
95fc58dc321b07ecc99d95359bcdee08a5beb519ead8e70e40f33928533a1b14	hash	phishing	80	3
185633e5dbe9235fc7e6a1ccb8631650afefd8f7da88c5c07d9b99ea38159822	sha256	—	80	1
7fda5f10a2bc212daaa467484c56eb8abf3f3681f6405c5c2fac16d4124e44ca	hash	phishing	80	3
52fda5c1b9704544f32ee98d9060e689	hash	ransomware	80	2
375c2c84e2ca022c565507523b75c9c08a455479861ea41fc9b9ff74b3453445	hash	phishing	80	3
51d39aa39478beeac94f2d12f682ecce	hash	ransomware	80	2
21ca0287ec5eaee8fb2f5d0542e378267d6ca0a6	sha1	—	78	1
2c6cc71b7e7e4b28c2c176b504bc5bdb687c4d41	sha1	—	78	1
fc0c691db7e2d2bd3b0b4c1e24d18df72168b7d9	sha1	—	78	1
95bdb94f6767a3cce6d92363bbf5bc84b786bdb0	sha1	—	78	1
03e3ece9f48cf4104aafc535790ca2fb3c6b26cf	sha1	—	78	1
5b70453ab58824a65ed0b6175c903aa022a87d6a	sha1	—	78	1
7356d7868c81499fb4e720f7c9530e5763b4c1d0	sha1	—	78	1
01a33066fbc6253304c92760916329abd50c3191	sha1	—	78	1
2b81f78ec4c3f8d6cf8f677d141c5d13c35333af	sha1	—	78	1
f9f6c0184cee9c1e4e15c2a73e56d7b927ea685b	sha1	—	78	1
409c5acaed587f62f7e23da47f72c4d9ec3144d9	sha1	—	78	1
d9a369e328ea4f1b8304b6e11b50275f798e9d6b	sha1	—	78	1
59a9b9d47ae36411b277544f25ad2cc955d8dd2c	sha1	—	78	1
a48b62e55a692bf6d1046d2be64d7150	md5	—	76	1
a0830ce48537ba052f1d3b905d11a5bf	md5	—	76	1

Showing the top 30 by severity of 151.