Skip to content

Blue Mockingbird

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

ATT&CK ID: G0108
Techniques: 19
Tools: 2

Vulnerabilities it has exploited

CVE-2019-18935 Progress Telerik UI for ASP.NET AJAXUnscored · exploited in the wild

Techniques

Resource Development

Obtain Capabilities

Initial Access

Exploit Public-Facing Application

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter System Services Hijack Execution Flow

Persistence

Scheduled Task/Job Modify Registry Create or Modify System Process Event Triggered Execution

Privilege Escalation

Scheduled Task/Job Access Token Manipulation Create or Modify System Process Event Triggered Execution

Stealth

Obfuscated Files or Information Masquerading Access Token Manipulation System Binary Proxy Execution Hijack Execution Flow

Defense Impairment

Modify Registry

Credential Access

OS Credential Dumping

Discovery

System Information Discovery

Lateral Movement

Remote Services

Command and Control

Impact

Resource Hijacking

Software

FRP · Mimikatz

MITRE ATT&CK All threat actors