Home / Threat actors / Rocke
Rocke G0106
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
2
associated CVEs
43
Techniques
0
Malware and tools
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”
CVE-2017-10271
High · 7.5
KEV Ransomware Oracle Corporation WebLogic Server Remote Code Execution Vulnerability
“Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”
Techniques by tactic
Initial Access
T1190 Exploit Public-Facing Application Execution
T1053.003 CronT1059.004 Unix ShellT1059.006 PythonT1574.006 Dynamic Linker Hijacking Persistence
T1037 Boot or Logon Initialization ScriptsT1053.003 CronT1543.002 Systemd ServiceT1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1037 Boot or Logon Initialization ScriptsT1053.003 CronT1055.002 Portable Executable InjectionT1543.002 Systemd ServiceT1547.001 Registry Run Keys / Startup Folder Stealth
T1014 RootkitT1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.004 Compile After DeliveryT1036.005 Match Legitimate Resource Name or LocationT1055.002 Portable Executable InjectionT1070.004 File DeletionT1070.006 TimestompT1140 Deobfuscate/Decode Files or InformationT1564.001 Hidden Files and DirectoriesT1574.006 Dynamic Linker Hijacking Defense Impairment
T1222.002 Linux and Mac PermissionsT1685 Disable or Modify ToolsT1685.006 Clear Linux or Mac System LogsT1686 Disable or Modify System Firewall Credential Access
T1552.004 Private Keys Discovery
T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1518.001 Security Software Discovery Lateral Movement
T1021.004 SSH Command and Control
T1071 Application Layer ProtocolT1071.001 Web ProtocolsT1102 Web ServiceT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1571 Non-Standard Port Impact
T1496.001 Compute Hijacking © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.