aol.pm

Virtual Private Server

Subtechnique · ATTACK:enterprise:T1583.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1583.003",
  "title": "Virtual Private Server",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1583/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--79da0971-3147-4af6-a4f5-e8cd447cd795",
  "external_id": "T1583.003",
  "domain": "enterprise",
  "created": "2020-10-01T00:44:23.935Z",
  "modified": "2026-09-18T00:31:18.339Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "Koczwara Beacon Hunting Sep 2021",
      "url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
    },
    {
      "source_name": "TrendmicroHideoutsLease",
      "url": "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf"
    },
    {
      "source_name": "Mandiant SCANdalous Jul 2020",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
    },
    {
      "source_name": "ThreatConnect Infrastructure Dec 2020",
      "url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
    }
  ]
}

Explicit source assertions (28)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09f8f0a2-a94f-466e-af4f-cf29ca6794c7

Huntio_GamaredonFlux_Apr2025 · ESET Gamaredon Sept2024 · unit42_gamaredon_dec2022

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b267d23-7c3c-41cd-878e-5466e0743340

Leonard TAG 2023

ATTACK:enterprise:C0053 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bb1fe87-de75-4030-9b9c-691671412be1

ORB Mandiant

ATTACK:enterprise:C0050 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1da74c46-5793-4671-94b6-0941742f3da6

Lumen J-Magic JAN 2025

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2040abd8-0c8e-4a0e-9a7c-d4a7429d44e6

AI-Mexico-Govt-Breach

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27238f34-4478-4141-8f51-0ddb08ba134f

FireEye TRITON 2019

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35bfa368-bdf2-4a1e-8723-dafb788d5ddf

CISA GRU29155 2024

ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35f32f94-c724-4c50-a61e-1334fade16be

Cisco ArcaneDoor 2024

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e375d96-bc20-431e-ab35-f2e05fb88343

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50192f98-81e1-4175-9070-5576c6b93b65

Talos Sea Turtle 2019

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ce803ed-e46c-4e07-980d-3322325a863e

SentinelOne WinterVivern 2023

ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61fc1735-c822-497a-8d6e-ced7fd4e1a8a

PWC Yellow Liderc 2023

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73c1d325-116d-4a33-9b57-912ad12decd5

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76f7672f-5ae8-4bb7-8eab-823b1b43699b

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7712ca00-da29-4b3a-938d-82b362814a78

FBI BlackByte 2022

ATTACK:enterprise:T1583.003 → subtechnique-of → ATTACK:enterprise:T1583

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78bde505-a353-4cae-a978-f87de382f3fd

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d68b5ba-dc59-4004-9742-3fbb0b22440e

Lumen KVBotnet 2023

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fec8e28-cc68-4245-b96c-1cf2b0b8c31a

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a12a296d-3cdb-4a49-840a-4ecd073b5312

Novetta-Axiom

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7a27fb9-551b-4f6c-9d5a-3c230366bd85

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8a36225-90e9-446f-98ac-9a05739f994b

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae28ef39-1e4f-41e5-9ffa-877030753852

Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3afb812-f91e-44de-8a11-fc0fa73e0deb

Recorded Future TAG-144 AUG 2025

ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c54b00ec-fdb7-483e-ad6e-be4fb1da0fd8

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca88bb6a-5f55-4303-aad9-a8715ba69c41

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6d7deaf-8ed1-437b-87ab-c2270015c96d

Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:C0052 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de87a278-7df0-4c33-9e94-68cb531dc994

ORB Mandiant

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fedcb717-2453-4c77-8f05-8a28f934725e

Microsoft HAFNIUM March 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.