T1583.003 Virtual Private Server

Technique: T1583.003
Tactics: Resource Development
Research, 90 days: 3
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1583/003

MITRE description

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-26 Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack
2026-10-08 ESET: MATCHBOIL: New tricks, same old evil intentions
2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch

Detection coverage

Coverage data unavailable in this snapshot (community inventory not yet ingested).

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.