MITRE ATT&CKgroup

G0106 Rocke

Published 2020-05-26 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2020-05-26

Description

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "[email protected]" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.

Related

Uses · MITRE ATT&CK (36)

  • T1685 Disable or Modify Tools technique
  • T1685.006 Clear Linux or Mac System Logs sub-technique
  • T1686 Disable or Modify System Firewall technique
  • T1496.001 Compute Hijacking sub-technique
  • T1027.004 Compile After Delivery sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1571 Non-Standard Port technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1059.006 Python sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1021.004 SSH sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1222.002 Linux and Mac Permissions sub-technique
  • T1552.004 Private Keys sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.002 Systemd Service sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1053.003 Cron sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1014 Rootkit technique
  • T1018 Remote System Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1037 Boot or Logon Initialization Scripts technique
Show all 36 ›

References