Início / Grupos de ameaça / Rocke

Rocke G0106

🔔 Criar alerta

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

43

Técnicas

0

Malwares e ferramentas

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2017-3066 Crítica · 9.8 KEV Adobe ColdFusion Deserialization Vulnerability

“Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”

CVE-2017-10271 Alta · 7.5 KEV Ransomware Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

“Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”

Técnicas por tática

Acesso inicial

T1190 Exploit Public-Facing Application

Execução

T1053.003 Cron T1059.004 Unix Shell T1059.006 Python T1574.006 Dynamic Linker Hijacking

Persistência

T1037 Boot or Logon Initialization Scripts T1053.003 Cron T1543.002 Systemd Service T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1037 Boot or Logon Initialization Scripts T1053.003 Cron T1055.002 Portable Executable Injection T1543.002 Systemd Service T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1014 Rootkit T1027 Obfuscated Files or Information T1027.002 Software Packing T1027.004 Compile After Delivery T1036.005 Match Legitimate Resource Name or Location T1055.002 Portable Executable Injection T1070.004 File Deletion T1070.006 Timestomp T1140 Deobfuscate/Decode Files or Information T1564.001 Hidden Files and Directories T1574.006 Dynamic Linker Hijacking

Comprometimento de defesas

T1222.002 Linux and Mac Permissions T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall

Acesso a credenciais

T1552.004 Private Keys

Descoberta

T1018 Remote System Discovery T1046 Network Service Discovery T1057 Process Discovery T1082 System Information Discovery T1518.001 Security Software Discovery

Movimento lateral

T1021.004 SSH

Comando e controle

T1071 Application Layer Protocol T1071.001 Web Protocols T1102 Web Service T1102.001 Dead Drop Resolver T1105 Ingress Tool Transfer T1571 Non-Standard Port

Impacto

T1496.001 Compute Hijacking

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.