MITRE ATT&CKgroup

G0108 Blue Mockingbird

Published 2020-05-26 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.3
Created
2020-05-26

Description

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

Related

Uses · MITRE ATT&CK (24)

  • T1496.001 Compute Hijacking sub-technique
  • S1144 FRP software (tool)
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1588.002 Tool sub-technique
  • T1574.012 COR_PROFILER sub-technique
  • T1569.002 Service Execution sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1543.003 Windows Service sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1190 Exploit Public-Facing Application technique
  • T1134 Access Token Manipulation technique
  • S0002 Mimikatz software (tool)
  • T1047 Windows Management Instrumentation technique
  • T1082 System Information Discovery technique
  • T1090 Proxy technique
  • T1112 Modify Registry technique

References