VPS Exploitation by Threat Actors - CYFIRMA
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Botnet - T1583.005 Botnet - T1584.005 Cloud Accounts - T1078.004 Cloud Accounts - T1585.003 Cloud Accounts - T1586.003 Dns - T1071.004 Dns - T1590.002 Internet Connection Discovery - T1016.001 System Network Configuration Discovery - T1422 Phishing - T1660 Phishing - T1566 Protocol Tunneling - T1572 Server - T1583.004 Server - T1584.004 Ssh - T1021.004 Virtual Private Server - T1583.003 Virtual Private Server - T1584.003 Connection Proxy - T1090 System Network Configuration Discovery - T1016
Show in Graph
Common Information
Type Value
UUID d74af220-77c4-4cbf-9531-116af99a9dfa
Fingerprint b471875da08a0558
Analysis status DONE
Considered CTI value 0
Text language
Published June 7, 2023, 6:25 a.m.
Added to db Dec. 18, 2024, 9:23 p.m.
Last updated Dec. 21, 2024, 3:59 a.m.
Headline VPS Exploitation by Threat Actors
Title VPS Exploitation by Threat Actors - CYFIRMA
Detected Hints/Tags/Attributes 46/2/6
Source URLs
Redirection Url
Details Redirection https://www.cyfirma.com/outofband/vps-exploitation-by-threat-actors/
Details Source https://www.cyfirma.com/research/vps-exploitation-by-threat-actors/
URL Provider
Details Provider Source level domain
Details cyfirma.com www.cyfirma.com
Attributes
Details Type #Events CTI Value
Details Domain 53 
xss.is
Details Domain 3 
crazyrdp.com
Details Domain 10 
cracked.io
Details File 31 
plink.exe
Details MITRE ATT&CK Techniques 101 
T1572
Details MITRE ATT&CK Techniques 46 
T1016.001