Home / Threat actors / Blue Mockingbird
Blue Mockingbird G0108
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
29
Techniques
2
Malware and tools
Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2019-18935
Critical · 9.8
KEV Ransomware Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
“Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.”
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1190 Exploit Public-Facing Application Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1569.002 Service ExecutionT1574.012 COR_PROFILER Persistence
T1053.005 Scheduled TaskT1112 Modify RegistryT1543.003 Windows ServiceT1546.003 Windows Management Instrumentation Event Subscription Privilege Escalation
T1053.005 Scheduled TaskT1134 Access Token ManipulationT1543.003 Windows ServiceT1546.003 Windows Management Instrumentation Event Subscription Stealth
T1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1134 Access Token ManipulationT1218.010 Regsvr32T1218.011 Rundll32T1574.012 COR_PROFILER Defense Impairment
T1112 Modify Registry Credential Access
T1003.001 LSASS Memory Discovery
T1082 System Information Discovery Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin Shares Command and Control
T1090 Proxy Impact
T1496.001 Compute Hijacking © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.