VOID MANTICOREG1055 ↗
Has utilized VPS solutions for C2.1
tfMITRE ATT&CK sub-technique
Virtual Private Server T1583.003
sub-technique of T1583 Acquire Infrastructure
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.1
- Created
- 01 October 2020
- Last modified
- 12 May 2026
Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
16
Threat groupsTop 11%
Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.6
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Virtual Private Server MITRE reference T1583.003
Top 11%of all ATT&CK techniques for number of groups
16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Contagious InterviewG1052 ↗
Has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting.12 Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.3
APT42G1044 ↗
Has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.12
BlackByteG1043 ↗
Staged encryption keys on virtual private servers operated by the adversary.1
Sea TurtleG1041 ↗
Created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture.1
Moonstone SleetG1036 ↗
Registered virtual private servers to host payloads for download.1
All 16 groups for this technique · 6 newest in this preview
6 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
ArcaneDoorC0046 ↗
Included the use of dedicated, adversary-controlled virtual private servers for command and control.1
J-magic CampaignC0050 ↗
During the J-magic Campaign, threat actors acquired VPS for use in C2.1
KV Botnet ActivityC0035 ↗
Used acquired Virtual Private Servers as control systems for devices infected with KV Botnet malware.1
FLORAHOX ActivityC0053 ↗
Has used acquired Virtual Private Servers as control systems for the ORB network.1
SPACEHOP ActivityC0052 ↗
Has used acquired Virtual Private Servers as control systems for devices within the ORB network.1
C0032C0032 ↗
During the C0032 campaign, TEMP.Veles used Virtual Private Server (VPS) infrastructure.1
All 6 campaigns for this technique
Offense vs defense T1583.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Virtual Private Server detection strategy DET0838
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Virtual Private Server
1 platform
AN1970 · PRE
Once adversaries have provisioned a VPS (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Response ContentDC0104 | Internet Scan | None |
| Response MetadataDC0106 | Internet Scan | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.