| ID | Name |
|---|---|
| T1584.001 | Domains |
| T1584.002 | DNS Server |
| T1584.003 | Virtual Private Server |
| T1584.004 | Server |
| T1584.005 | Botnet |
| T1584.006 | Web Services |
| T1584.007 | Serverless |
| T1584.008 | Network Devices |
Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.[1] Instead of purchasing aServer orVirtual Private Server, adversaries may compromise third-party servers in support of operations.
Adversaries may also compromise web servers to support watering hole operations, as inDrive-by Compromise, or email servers to supportPhishing operations.
| ID | Name | Description |
|---|---|---|
| G0023 | APT16 | APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.[2] |
| G1034 | Daggerfly | Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.[3] |
| G0035 | Dragonfly | Dragonfly has compromised legitimate websites to host C2 and malware modules.[4] |
| G1006 | Earth Lusca | Earth Lusca has used compromised web servers as part of their operational infrastructure.[1] |
| G0119 | Indrik Spider | Indrik Spider has served fake updates via legitimate websites that have been compromised.[5] |
| C0044 | Juicy Mix | DuringJuicy Mix,OilRig compromised an Israeli job portal to use for a C2 server.[6] |
| G0032 | Lazarus Group | Lazarus Group has compromised servers to stage malicious tools.[7] |
| G0065 | Leviathan | Leviathan has used compromised legitimate websites as command and control nodes for operations.[8] |
| C0002 | Night Dragon | DuringNight Dragon, threat actors compromised web servers to use for C2.[9] |
| C0022 | Operation Dream Job | ForOperation Dream Job,Lazarus Group compromised servers to host their malicious tools.[10][11][12] |
| C0013 | Operation Sharpshooter | ForOperation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.[13] |
| C0042 | Outer Space | DuringOuter Space,OilRig compromised an Israeli human resources site to use as a C2 server.[6] |
| G0034 | Sandworm Team | Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.[14][15] |
| G0010 | Turla | Turla has used compromised servers as infrastructure.[16][17][18] |
| G1017 | Volt Typhoon | Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.[19][20] |
| ID | Mitigation | Description |
|---|---|---|
| M1056 | Pre-compromise | This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0874 | Detection of Server | AN2006 | Once adversaries have provisioned software on a compromised server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have compromised. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.[21][22][23] |