H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Virtual Private Server

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)

24 recorded

Relationships

mitigates
from Pre-compromise
Mitigation
subtechnique-of
to Acquire Infrastructure
Technique
uses
from APT28
Group
uses
from APT42
Group
uses
from APT-C-36
Group
uses
from ArcaneDoor
Campaign
uses
from Axiom
Group
uses
from BlackByte
Group
uses
from C0032
Campaign
uses
from Contagious Interview
Group
uses
from CURIUM
Group
uses
from Dragonfly
Group
uses
from Ember Bear
Group
uses
from FLORAHOX Activity
Campaign
uses
from Gamaredon Group
Group
uses
from HAFNIUM
Group
uses
from J-magic Campaign
Campaign
uses
from KV Botnet Activity
Campaign
uses
from LAPSUS$
Group
uses
from Moonstone Sleet
Group
uses
from Sea Turtle
Group
uses
from SPACEHOP Activity
Campaign
uses
from VOID MANTICORE
Group
uses
from Winter Vivern
Group
5 external

References

mitre-attack
T1583.003
open
Koczwara Beacon Hunting Sep 2021
https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
open
TrendmicroHideoutsLease
https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf
open
Mandiant SCANdalous Jul 2020
https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
open
ThreatConnect Infrastructure Dec 2020
https://threatconnect.com/blog/infrastructure-research-hunting/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance