G0106 · 36 ATT&CK techniques · 0 correlated reports

Rocke

Aliases: None listed

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.

Open interactive actor investigation

ATT&CK techniques

T1190
Exploit Public-Facing Application T1014
Rootkit T1027
Obfuscated Files or Information T1102
Web Service T1562.004
Disable or Modify System Firewall T1059.004
Unix Shell T1082
System Information Discovery T1071
Application Layer Protocol T1105
Ingress Tool Transfer T1496.001
Compute Hijacking T1027.004
Compile After Delivery T1574.006
Dynamic Linker Hijacking T1564.001
Hidden Files and Directories T1053.003
Cron T1059.006
Python T1046
Network Service Discovery T1055.002
Portable Executable Injection T1102.001
Dead Drop Resolver T1037
Boot or Logon Initialization Scripts T1027.002
Software Packing T1070.002
Clear Linux or Mac System Logs T1547.001
Registry Run Keys / Startup Folder T1222.002
Linux and Mac File and Directory Permissions Modification T1057
Process Discovery T1543.002
Systemd Service T1018
Remote System Discovery T1140
Deobfuscate/Decode Files or Information T1562.001
Disable or Modify Tools T1552.004
Private Keys T1070.004
File Deletion T1071.001
Web Protocols T1571
Non-Standard Port T1021.004
SSH T1070.006
Timestomp T1036.005
Match Legitimate Name or Location T1518.001
Security Software Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research