Procedure examples

Dragonfly has acquired VPS infrastructure for use in malicious campaigns.

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.

Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.

CURIUM created virtual private server instances to facilitate use of malicious domains and other items.

Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.

Sea Turtle created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture.

Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.

Axiom has used VPS hosting providers in targeting of intended victims.

Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.

APT28 hosted phishing domains on free services for brief periods of time during campaigns.

APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.

APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.

LAPSUS$ has used VPS hosting providers for infrastructure.

Moonstone Sleet registered virtual private servers to host payloads for download.

VOID MANTICORE has utilized VPS solutions for C2.

During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.

For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.

During Night Dragon, threat actors purchased hosted services to use for C2.

For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.

GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.

Mustard Tempest has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.

CURIUM has created dedicated servers for command and control and exfiltration purposes.

Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.

VOID MANTICORE has leveraged backend servers within Iran.

TeamPCP has leased infrastructure specifically for offensive operations including Google assets in AS396982.

ShinyHunters has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.

HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.

Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.

APT5 has acquired a network of compromised systems – specifically an ORB (operational relay box) network – for follow on activities.

During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.

For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.

During the 2025 Poland Wiper Attacks, the adversaries configured the FortiGate devices to send notifications to an attacker-controlled Slack channel. During the 2025 Poland Wiper Attacks, the adversaries had also staged tools and files on services such as Dropbox and Pastebin.

APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot. Kimsuky has also leveraged Dropbox for hosting payloads and uploading victim system information.

APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.

HAFNIUM has acquired web services for use in C2 and exfiltration.

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.

FIN7 has set up Amazon S3 buckets to host trojanized digital products.

Mustang Panda has set up Dropbox and Google Drive to host malicious downloads.

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.

TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.

Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.

Confucius has obtained cloud storage service accounts to host stolen data.

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.