Compromise Infrastructure: Virtual Private Server (T1584.003) is a resource development technique tagged PRE. The adversary takes over a VPS that a third party bought, rather than buying one.
If you run a VPS, this is a technique that could use you without ever touching your main network.
How attackers use it
MITRE describes cloud providers selling virtual machines and containers as a service. Adversaries may compromise VPSs bought by third parties. By doing so, they make it difficult to physically tie operations back to themselves.
The page names command and control as an example of a later stage. A compromised VPS lets adversaries benefit from the ubiquity and trust of a higher reputation cloud provider, plus whatever trust the compromised owner has. Traffic to a well-known provider is less likely to be blocked than traffic to an unknown host.
How to detect it
MITRE says that once adversaries have provisioned software on a compromised VPS, for example a command and control server, internet scans may reveal it. Look for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary command and control software.
It also says much of the activity is outside the visibility of the target organization, so effort should go to related stages such as command and control.
If you own VPSs, apply the same idea to yourself:
- Scan your own address space from outside and compare open ports with the expected list.
- Review outbound connections from each VPS. A web server that suddenly calls out to many unrelated hosts needs attention.
- Check certificates presented by your hosts for names you did not request.
- Watch for new processes, scheduled tasks and user accounts on the host.
How to reduce the risk
MITRE's mitigation entry is Pre-compromise. Prevention at the target side is not practical, because the compromise happens at a third party.
If you are the VPS owner, these general practices reduce the chance of becoming that third party.
- Keep the operating system and exposed services patched.
- Use key based logins and disable password logins over SSH where you can.
- Close every port you do not use, and restrict management access to known addresses.
- Delete VPSs that nobody uses. Forgotten hosts are the ones that go unpatched.
- Send logs off the host so that an intruder cannot easily erase them.
A final tip for owners: keep a simple register of every VPS with its purpose, owner and renewal date. When a host has no owner, it is a candidate for shutdown. Hosts that nobody watches are the ones an adversary can use for months before anyone asks why the traffic bill grew.
Check your own environment
- List every VPS and container host in your cloud accounts, with an owner for each.
- Linux, read-only:
ss -tlnplists listening services and the owning process. Compare with what you expect. - Linux, read-only:
last -n 20shows recent logins, andgrep "Failed password" /var/log/auth.logshows failed SSH attempts on Debian family systems. - From a separate network, scan your own addresses with a tool you are authorized to use and compare the results with your inventory.
Quick check
Why does a compromised VPS help an adversary hide?
It makes operations harder to tie back to them, and it benefits from the trust of a high reputation cloud provider.
What may reveal compromised VPSs, according to MITRE?
Internet scans that look for patterns such as listening services, certificates, TLS negotiation features and other artifacts of adversary command and control software.
