Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.1 Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.
- TrendMicro EarthLusca 2022
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0023 | APT16 | China |
| grp_g1034 | Daggerfly | — |
| grp_g0032 | Lazarus Group | DPRK |
| grp_g0119 | Indrik Spider | Russia |
| grp_g0035 | Dragonfly | Russia |
| grp_g1017 | Volt Typhoon | — |
| grp_g0065 | Leviathan | China |
| grp_g0010 | Turla | Russia |
| grp_g1006 | Earth Lusca | China |
| grp_g0034 | Sandworm Team | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.