Skip to content

Rocke

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.

ATT&CK ID: G0106
Origin: China
Techniques: 29
Tools: 0

Vulnerabilities it has exploited

Techniques

Initial Access

Exploit Public-Facing Application

Execution

Scheduled Task/Job Command and Scripting Interpreter Hijack Execution Flow

Persistence

Boot or Logon Initialization Scripts Scheduled Task/Job Create or Modify System Process Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Initialization Scripts Scheduled Task/Job Process Injection Create or Modify System Process Boot or Logon Autostart Execution

Stealth

Rootkit Obfuscated Files or Information Masquerading Process Injection Indicator Removal Deobfuscate/Decode Files or Information Hide Artifacts Hijack Execution Flow

Defense Impairment

File and Directory Permissions Modification Disable or Modify Tools Disable or Modify System Firewall

Credential Access

Unsecured Credentials

Discovery

Remote System Discovery Network Service Discovery Process Discovery System Information Discovery Software Discovery

Lateral Movement

Remote Services

Command and Control

Application Layer Protocol Web Service Ingress Tool Transfer Non-Standard Port

Impact

Resource Hijacking

MITRE ATT&CK All threat actors