CybercrimeMITRE G0106
Rocke
Also known as Aged Libra
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability. In late July, we became aware that the same actor was engaged in another similar campaign. Through our investigation into this new campaign, we were able to uncover more details about the actor.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1014 RootkitT1018 Remote System DiscoveryT1021.004 SSHT1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.004 Compile After DeliveryT1036.005 Match Legitimate Resource Name or LocationT1037 Boot or Logon Initialization ScriptsT1046 Network Service DiscoveryT1053.003 CronT1055.002 Portable Executable InjectionT1057 Process DiscoveryT1059.004 Unix ShellT1059.006 PythonT1070.004 File DeletionT1070.006 TimestompT1071 Application Layer ProtocolT1071.001 Web ProtocolsT1082 System Information DiscoveryT1102 Web ServiceT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1222.002 Linux and Mac PermissionsT1496.001 Compute HijackingT1518.001 Security Software DiscoveryT1543.002 Systemd ServiceT1547.001 Registry Run Keys / Startup FolderT1552.004 Private KeysT1564.001 Hidden Files and DirectoriesT1571 Non-Standard PortT1574.006 Dynamic Linker HijackingT1685 Disable or Modify ToolsT1685.006 Clear Linux or Mac System LogsT1686 Disable or Modify System Firewall
Recent activity
No posts or advisories have named this actor recently.
References
- https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html
- https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/
- https://www.intezer.com/blog-technical-analysis-cryptocurrency-mining-war-on-the-cloud/
- https://unit42.paloaltonetworks.com/atoms/agedlibra/
- https://attack.mitre.org/groups/G0106
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.