G0106: Rocke

G0106: Rocke describes [Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this at...

Executive priority

G0106: Rocke is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0106: Rocke by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether G0106: Rocke appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Rocke

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques36 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1190	Exploit Public-Facing Application	Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.[1]CitationUnit 42 Rocke January 2019
Enterprise	T1014	Rootkit	Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.CitationAnomali Rocke March 2019
Enterprise	T1027	Obfuscated Files or Information	Rocke has modified UPX headers after packing files to break unpackers.CitationAnomali Rocke March 2019
Enterprise	T1102	Web Service	Rocke has used Pastebin, Gitee, and GitLab for Command and Control.CitationAnomali Rocke March 2019[1]
Enterprise	T1059.004	Unix ShellSub-technique	Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.[1]
Enterprise	T1082	System Information Discovery	Rocke has used uname -m to collect the name and information about the infected system's kernel.CitationAnomali Rocke March 2019
Enterprise	T1071	Application Layer Protocol	Rocke issued wget requests from infected systems to the C2.[1]
Enterprise	T1105	Ingress Tool Transfer	Rocke used malware to download additional malicious files to the target system.[1]
Enterprise	T1496.001	Compute HijackingSub-technique	Rocke has distributed cryptomining malware.[1]CitationUnit 42 Rocke January 2019
Enterprise	T1027.004	Compile After DeliverySub-technique	Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).CitationAnomali Rocke March 2019
Enterprise	T1574.006	Dynamic Linker HijackingSub-technique	Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.CitationAnomali Rocke March 2019
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	Rocke downloaded a file "libprocesshider", which could hide files on the target system.[1]CitationUnit 42 Rocke January 2019
Enterprise	T1053.003	CronSub-technique	Rocke installed a cron job that downloaded and executed files from the C2.[1]CitationUnit 42 Rocke January 2019CitationAnomali Rocke March 2019
Enterprise	T1059.006	PythonSub-technique	Rocke has used Python-based malware to install and spread their coinminer.CitationAnomali Rocke March 2019
Enterprise	T1046	Network Service Discovery	Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.[1]CitationAnomali Rocke March 2019
Enterprise	T1055.002	Portable Executable InjectionSub-technique	Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.[1]
Enterprise	T1102.001	Dead Drop ResolverSub-technique	Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.CitationAnomali Rocke March 2019
Enterprise	T1037	Boot or Logon Initialization Scripts	Rocke has installed an "init.d" startup script to maintain persistence.CitationAnomali Rocke March 2019
Enterprise	T1027.002	Software PackingSub-technique	Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.[1]CitationUnit 42 Rocke January 2019CitationAnomali Rocke March 2019
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.[1]
Enterprise	T1222.002	Linux and Mac PermissionsSub-technique	Rocke has changed file permissions of files so they could not be modified.CitationAnomali Rocke March 2019
Enterprise	T1057	Process Discovery	Rocke can detect a running process's PID on the infected machine.CitationAnomali Rocke March 2019
Enterprise	T1543.002	Systemd ServiceSub-technique	Rocke has installed a systemd service script to maintain persistence.CitationAnomali Rocke March 2019
Enterprise	T1018	Remote System Discovery	Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.[1]
Enterprise	T1686	Disable or Modify System Firewall	Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Rocke has extracted tar.gz files after downloading them from a C2 server.[1]
Enterprise	T1685.006	Clear Linux or Mac System LogsSub-technique	Rocke has cleared log files within the /var/log/ folder.CitationAnomali Rocke March 2019
Enterprise	T1552.004	Private KeysSub-technique	Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.CitationAnomali Rocke March 2019
Enterprise	T1070.004	File DeletionSub-technique	Rocke has deleted files on infected machines.CitationAnomali Rocke March 2019
Enterprise	T1071.001	Web ProtocolsSub-technique	Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.CitationAnomali Rocke March 2019
Enterprise	T1685	Disable or Modify Tools	Rocke used scripts which detected and uninstalled antivirus software.[1]CitationUnit 42 Rocke January 2019
Enterprise	T1571	Non-Standard Port	Rocke's miner connects to a C2 server using port 51640.CitationAnomali Rocke March 2019
Enterprise	T1021.004	SSHSub-technique	Rocke has spread its coinminer via SSH.CitationAnomali Rocke March 2019
Enterprise	T1070.006	TimestompSub-technique	Rocke has changed the time stamp of certain files.CitationAnomali Rocke March 2019
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	Rocke has used shell scripts which download mining executables and saves them with the filename "java".[1]
Enterprise	T1518.001	Security Software DiscoverySub-technique	Rocke used scripts which detected and uninstalled antivirus software.[1]CitationUnit 42 Rocke January 2019

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.0
Created: May 26, 2020, 14:20 UTC (UTC+00:00)
Modified: Jul 31, 2026, 18:47 UTC (UTC+00:00)
Raw hash: bf9ba024bbc074d0...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.0	Jul 31, 2026, 18:47 UTC (UTC+00:00)	Current bundle	`bf9ba024bbc0…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Jul 31, 2026, 18:47 UTC (UTC+00:00)	Older bundle	`bf9ba024bbc0…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Apr 25, 2025, 14:49 UTC (UTC+00:00)	Older bundle	`493d858defd7…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Talos Rocke August 2018
Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.
Open source URL
[2]
mitre-attackG0106
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use