Certification Courses
Hands-On Labs
Threat Intelligence
Latest Cyber News
MITRE ATT&CK Breakdown
All Cyber Keywords
Latest News
TA0042, Resource Development
T1583.003, Virtual Private Server
Adversaries rent cloud-based VPS infrastructure to establish anonymous, rapidly provisioned, and geographically distributed command-and-control nodes—exploiting the trust and ubiquity of major cloud providers.
MITRE ATT&CK • Enterprise • Sub-technique T1583.003
VPS Provisioning Simulation
Adversary Infrastructure Dashboard
OPERATIONAL, 5 Nodes Active
AWS (us-east-1)
Leaseweb (SG)
Kaopu Cloud (HK)
Tier[.]Net (NL)
Stark Industries (RU)
AWS
US-East-1 (Virginia)
54.237.xxx.xxx
4 vCPU
8 GB
100 GB
Leaseweb
Singapore (SG)
103.253.xxx.xxx
2 vCPU
4 GB
50 GB
Kaopu
Hong Kong (HK)
156.232.xxx.xxx
8 vCPU
16 GB
500 GB
Tier[.]Net
Amsterdam (NL)
185.107.xxx.xxx
1 vCPU
2 GB
20 GB
Stark Ind.
Moscow (RU)
91.215.xxx.xxx
2 vCPU
4 GB
40 GB
root@vps-sg-01:~# apt update && apt install -y nginx python3 docker.io
[OK] Packages installed successfully
root@vps-sg-01:~# docker run -d --name c2-relay -p 443:443 c2image:latest
[OK] Container c2-relay started on port 443
root@vps-sg-01:~# systemctl enable --now nginx && certbot --nginx -d update.service-check.net
[OK] TLS certificate obtained for update.service-check.net
root@vps-sg-01:~# python3 /opt/stager/implant_gen.py --format exe --out /var/www/html/updates/
[WARN] Payload staging complete, 14 implants generated
root@vps-sg-01:~# iptables -A INPUT -s <victim_subnet> -j ACCEPT
Multi-Provider Connection Flow
Operator
VPS Fleet
Victim
Infrastructure Across 3 Continents
AWS
Virginia, US
Leaseweb
Singapore
Kaopu
Hong Kong
Tier[.]Net
Amsterdam, NL
Stark Ind.
Moscow, RU
Operator
VPS Providers (BTC/XMR)
Provider Tier[.]Net Suspended
Rotating C2 to Stark Industries
New VPS Provisioning in 4m 22s
Why It Matters
Virtual Private Servers represent the single most common infrastructure acquisition method used by adversaries worldwide. The ease of provisioning, combined with the inherent trust associated with major cloud providers, makes VPS-based infrastructure extremely difficult for defenders to block at scale. From nation-state APT groups to financially motivated cybercriminals, nearly every threat actor relies on rented VPS instances to anchor their operations.
Most-Used Adversary Infrastructure
VPS is the dominant infrastructure type for C2, payload delivery, and data exfiltration. Over 28,000 servers used by threat actors were tracked in 2024 alone, the vast majority being cloud VPS instances.
Bridewell CTI 2025 ReportImpossible to Block at Scale
Major cloud providers (AWS, Azure, GCP, DigitalOcean) host millions of legitimate customers. Blocking VPS IP ranges would cause catastrophic collateral damage to normal business operations, giving adversaries persistent cover.
Rapid Provisioning & Teardown
VPS instances can be created in under 5 minutes via API or web console and torn down just as quickly. This allows adversaries to rotate infrastructure faster than defenders can blacklist it.
Bulletproof Hosting Ecosystem
A dedicated ecosystem of "bulletproof" VPS providers caters specifically to cybercriminals, offering minimal KYC requirements, cryptocurrency payments, and deliberate ignorance of abuse reports. Providers like Stark Industries Solutions and RouterHosting exemplify this market.
100+ Active Bulletproof ProvidersGeographic Distribution
Adversaries spread VPS infrastructure across multiple countries and continents to complicate attribution, avoid jurisdictional takedowns, and maintain resilient multi-path C2 chains that survive individual node losses.
Cloud Provider Trust Exploitation
IP addresses from reputable cloud providers carry implicit trust, making it harder for firewalls and email filters to block traffic. In 2025, attackers were observed abusing VPS providers like Hyonix to compromise SaaS accounts via trusted infrastructure.
Darktrace / Infosecurity MagazineKey Terms & Concepts
Everyday Analogy
"Like renting an apartment under a fake name, it's a temporary, anonymous base of operations where you can plan activities without being traced back to your real identity. You can rent multiple apartments across different cities, pay cash, and abandon any one of them the moment authorities come knocking."
Renting a VPS for cyber operations means acquiring a virtual machine from a cloud service provider that serves as a remote, controllable server. Adversaries use these rented servers as the backbone of their attack infrastructure, hosting command-and-control frameworks, staging malware payloads, exfiltrating stolen data, and conducting reconnaissance against target networks.
Virtual Private Server (VPS)
A virtualized server instance hosted on shared physical hardware, offering dedicated resources (CPU, RAM, storage) at a fraction of dedicated server costs. Rentable by the hour or month from cloud providers worldwide.
Cloud Instance
A compute resource provisioned from a cloud provider's infrastructure (e.g., AWS EC2, Azure VM, DigitalOcean Droplet). Adversaries exploit the massive scale and API-driven provisioning to rapidly deploy and destroy infrastructure.
Bulletproof Hosting
Hosting providers that intentionally ignore abuse complaints, require minimal or no identity verification, and accept cryptocurrency payments. These providers actively cater to cybercriminals and are explicitly designed to resist takedown requests.
Provider Trust Exploitation
Leveraging the inherent reputation and trust associated with major cloud providers (AWS, Azure, Google Cloud). IP addresses from these providers are less likely to be blocked by security controls, providing adversaries with a "trusted" attack surface.
Rapid Provisioning
The ability to deploy new VPS instances in minutes via API calls or web dashboards. Enables adversaries to replace compromised infrastructure faster than defenders can detect, block, and attribute the new nodes.
Real-World Scenario
Nadia Kozlova is a sophisticated threat operator working as part of a financially motivated cybercrime group. Over a period of 18 months, she built and maintained a resilient adversary infrastructure spanning 5 different cloud providers across 3 continents, paying exclusively with cryptocurrency to preserve anonymity.
Nadia began by registering anonymous accounts with AWS (Virginia), Leaseweb (Singapore), and Kaopu Cloud (Hong Kong) using forged identities and prepaid cryptocurrency wallets. She provisioned small VPS instances initially, gradually upgrading resources as her operations scaled. On the AWS instance, she deployed her primary Cobalt Strike command-and-control server behind a legitimate-looking domain registered through a privacy-protecting registrar. The Leaseweb instance served as a payload staging server, hosting weaponized documents and malware droppers disguised as software updates. The Kaopu Cloud VPS was configured with 500 GB of storage and high bandwidth for bulk data exfiltration.
When Dutch hosting provider Tier[.]Net suspended one of her reconnaissance servers after receiving an abuse complaint, Nadia demonstrated the core advantage of multi-provider resilience: within 25 minutes, she had provisioned a replacement VPS from Stark Industries Solutions in Moscow, migrated her scanning tools, and updated her C2 configuration to route through the new node. The victim organization never detected the switch.
Month 1, Infrastructure Setup
Nadia registers accounts with 3 providers using forged KYC documents and Monero payments. Provisions initial VPS instances and deploys Nginx reverse proxies with valid TLS certificates.
Month 3, C2 Deployment
Deploys Cobalt Strike team server on AWS Virginia. Configures domain fronting through CloudFront CDN and establishes beacon communication profiles mimicking legitimate traffic patterns.
Month 6, Staging & Delivery
Leaseweb Singapore VPS begins hosting weaponized documents. Payloads are customized per target using intelligence gathered from LinkedIn and previous reconnaissance phases.
Month 10, Exfiltration at Scale
Kaopu Cloud HK instance activated for bulk data exfiltration. Over 2.4 TB of intellectual property, financial records, and credentials exfiltrated from 3 victim organizations.
Month 15, Rapid Rotation
Tier[.]Net suspends recon server. Nadia provisions replacement from Stark Industries (Moscow) in 25 minutes. C2 configuration updated without service interruption to victims.
Step-by-Step Guide
How adversaries systematically acquire and configure VPS infrastructure for cyber operations. Understanding these steps is critical for building effective detection and response capabilities.
1
Select VPS Providers DETECT
Adversaries research and select cloud providers that balance cost, performance, anonymity, and abuse tolerance. They often maintain accounts with 3–10 providers simultaneously.
- Prioritize bulletproof hosting providers (Stark Industries, RouterHosting) for sensitive infrastructure that may receive abuse reports
- Supplement with reputable providers (AWS, Azure, DigitalOcean) for legitimacy and IP reputation
- Geographically distribute across multiple jurisdictions to complicate takedowns and attribution, see T1583: Acquire Infrastructure
2
Create Anonymous Accounts PREVENT
Using cryptocurrency payments and forged or stolen identities, adversaries register accounts while minimizing personally identifiable information (PII) exposure.
- Pay with privacy-focused cryptocurrencies (Monero, Bitcoin through mixers) to avoid financial tracing
- Use VPN or Tor during registration to mask originating IP address, related to T1583.004: Domains
- Employ temporary email services and forged identity documents for providers requiring KYC verification
3
Provision and Configure VPS DETECT
Once accounts are created, adversaries rapidly provision VPS instances and harden them against detection by security scanners and cloud provider monitoring.
- Deploy minimal OS images and install required tools (web server, C2 framework, tunneling utilities) within hours of provisioning
- Configure TLS certificates through Let's Encrypt or commercial CAs to establish HTTPS for C2 communications
- Set up reverse proxies and domain fronting to hide true server IP addresses behind CDN infrastructure
4
Deploy C2 and Tools RESPOND
The VPS is transformed into an operational node by deploying command-and-control frameworks, malware toolkits, and exploitation utilities.
- Install C2 frameworks (Cobalt Strike, Sliver, Havoc) with custom Malleable C2 profiles mimicking legitimate traffic
- Stage malware payloads, weaponized documents, and initial access tools on separate VPS instances for defense-in-depth
- Configure automated reconnaissance and exploitation pipelines, see T1583.006: Web Services
5
Test Connectivity and OPSEC DETECT
Before launching operations, adversaries verify that C2 channels are reachable, traffic blends with legitimate patterns, and no configuration errors could expose their infrastructure.
- Test C2 beacon communication from spoofed or sandbox environments to confirm reachability and profile effectiveness
- Validate TLS certificate chains, domain resolution, and CDN configuration to prevent fingerprinting
- Verify that VPS IP addresses are not on known threat intelligence blocklists or have negative reputation
6
Implement Rotation and Redundancy RESPOND
Maintain a pool of pre-configured spare VPS instances that can be activated immediately if primary infrastructure is detected or suspended, ensuring operational continuity.
- Pre-provision 2–3 backup VPS instances across different providers and keep them in a warm standby state
- Automate C2 configuration updates to switch beacons between primary and backup infrastructure with minimal downtime
- Implement regular infrastructure rotation schedules (every 30–90 days) to stay ahead of threat intel blocklists
Common Mistakes & Best Practices
Common Mistakes
Single-provider dependency: Relying on only one VPS provider creates a single point of failure. When that provider suspends the account, all infrastructure goes offline simultaneously.
Using personal payment methods: Paying with credit cards or bank transfers linked to real identities provides law enforcement with direct financial trails for attribution.
Reusing IP addresses across operations: Using the same VPS IPs for multiple campaigns allows threat researchers to cluster and attribute seemingly separate incidents to a single group.
Ignoring certificate best practices: Self-signed TLS certificates or mismatched domain names are immediate red flags for network defenders monitoring SSL/TLS connections.
Failing to test OPSEC before deployment: Launching operations without validating that VPS infrastructure isn't already blocklisted or fingerprinted by security vendors leads to rapid detection.
Best Practices
Multi-provider redundancy: Maintain infrastructure across 3+ providers on different continents with automated failover configurations to ensure operational resilience.
Cryptocurrency-only payments: Use Monero or mixed Bitcoin exclusively for all infrastructure purchases to eliminate financial attribution vectors.
Regular infrastructure rotation: Implement a 30–90 day rotation schedule for all VPS instances, domains, and certificates to stay ahead of threat intelligence collection cycles.
Legitimate-looking hosting profiles: Host benign content alongside malicious infrastructure, use valid TLS certificates, and mimic normal web traffic patterns to blend with legitimate activity.
Comprehensive OPSEC validation: Pre-test all infrastructure against VirusTotal, security scanners, and threat intelligence platforms before deploying in active operations.
Red Team vs Blue Team View
Red Team Perspective
VPS infrastructure provides the operational backbone for adversary campaigns, anonymity, speed, and resilience are paramount.
- Anonymity through abstraction: VPS instances decouple the operator's physical location from the attack infrastructure, making attribution extremely difficult for defenders and law enforcement.
- Rapid provisioning via API: Cloud provider APIs enable programmatic VPS creation, allowing automated infrastructure deployment and scaling without manual intervention.
- Multi-provider resilience: Distributing infrastructure across multiple providers ensures that the loss of any single VPS (through suspension, takedown, or detection) does not compromise the entire operation.
- Cloud reputation exploitation: IP addresses from AWS, Azure, and Google Cloud carry implicit trust, reducing the effectiveness of IP-based blocking and enabling traffic to blend with legitimate business activity.
- Cost-effective scaling: Pay-per-hour VPS pricing models allow adversaries to scale infrastructure up for active operations and down during dormant periods, minimizing costs while maintaining readiness.
- Cryptocurrency payments: Using Monero and Bitcoin through mixing services eliminates financial paper trails, preventing payment providers and banks from identifying suspicious transactions.
Blue Team Perspective
Understanding VPS acquisition patterns enables proactive detection and faster response to adversary infrastructure.
- IP reputation intelligence: Subscribe to threat intelligence feeds that identify VPS-based C2 servers, newly provisioned cloud instances communicating with internal assets, and known bulletproof hosting ranges.
- VPS provider monitoring: Track which cloud providers and IP ranges are most frequently associated with malicious activity in your industry vertical to prioritize monitoring and filtering.
- Behavioral traffic analysis: Focus on detecting anomalous traffic patterns (beaconing intervals, data volume, connection timing) rather than relying solely on IP reputation, since legitimate and malicious VPS traffic often look identical at the network level.
- Certificate and domain analysis: Monitor for newly registered domains resolving to VPS IP addresses, especially those with TLS certificates obtained shortly after domain registration or using suspicious CA configurations.
- Geographic anomaly detection: Alert on unexpected geographic connections where internal systems communicate with VPS providers in jurisdictions unrelated to normal business operations.
- Cloud provider abuse reporting: Establish relationships with cloud provider abuse teams and file rapid abuse reports when adversary infrastructure is identified to accelerate takedowns.
Threat Hunter's Eye
Key hunting hypotheses and detection strategies for identifying adversary-controlled VPS infrastructure in your environment.
IP Reputation Feed Correlation
Cross-reference all outbound connections from internal systems against commercial and open-source IP reputation feeds (AbuseIPDB, VirusTotal, Shodan). Flag any connections to VPS provider IP ranges that appear in threat reports within the past 90 days.
High PriorityVPS Provider Monitoring
Create baseline profiles of which VPS providers (AWS, DigitalOcean, Linode, Vultr) your organization legitimately communicates with. Alert on any new VPS provider IP ranges appearing in outbound traffic that deviate from the established baseline.
High PriorityTLS Certificate Analysis
Monitor certificate transparency logs for newly issued TLS certificates associated with VPS IP addresses. Focus on certificates issued for domains with low character entropy (random-looking), recently registered domains, or certificates using free CAs (Let's Encrypt) for domains that mimic legitimate services.
Medium PriorityGeographic Anomaly Detection
Alert when internal systems initiate connections to VPS providers in countries or regions with no legitimate business relationship. Pay special attention to connections to bulletproof hosting jurisdictions (Russia, Netherlands, Panama, offshore islands).
High PriorityTemporal Beaconing Patterns
Analyze network traffic for regular beaconing patterns directed at VPS IP addresses. Adversary C2 servers hosted on VPS infrastructure often exhibit periodic check-in intervals (30s, 60s, 5min) that are detectable through statistical analysis of connection timing.
Medium PriorityWHOIS & Passive DNS Correlation
For identified VPS-based infrastructure, perform WHOIS lookups and passive DNS analysis to map the full infrastructure footprint. Adversaries often use consistent registration patterns (same registrars, same name servers, same registration dates) across multiple VPS-linked domains.
Low Priority (Intel Gathering)Sample Hunting Queries
1. Identify outbound connections to known VPS ASN ranges not in approved allow list
2. Detect TLS certificates issued in last 7 days resolving to VPS provider IPs
3. Flag DNS queries for recently registered domains resolving to cloud/VPS IPs
4. Hunt for beaconing patterns (Ricochet algorithm) to VPS provider IP blocks
5. Correlate User-Agent strings from VPS-originated connections for anomalies
Continue the Investigation
Explore Related MITRE ATT&CK Techniques
VPS acquisition is one component of the broader adversary infrastructure lifecycle. Understanding how it connects to domains, email accounts, and web services provides a complete picture of how threat actors build and maintain their operational platforms.
Virtual Private Server
MITIGATIONS
DETECTION STRATEGY
DONATE · SUPPORT
ROOT::DONATE
- April 7, 2026
- No Comments