Rocke

Origin🇨🇳 China

Techniques (MITRE ATT&CK)36

SourceMITRE ATT&CK

Also known as:Aged Libra

About the group

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity65

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 36

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Initial access

Exploit Public-Facing Application

Execution

Cron Unix Shell Python

Persistence

Boot or Logon Initialization Scripts Systemd Service Registry Run Keys / Startup Folder

Credential access

Private Keys

Discovery

Remote System Discovery Network Service Discovery Process Discovery System Information Discovery Security Software Discovery

Lateral movement

SSH

Command and control

Application Layer Protocol Web Protocols Web Service Dead Drop Resolver Ingress Tool Transfer Non-Standard Port

Impact

Compute Hijacking

defense-impairment

Linux and Mac Permissions Disable or Modify Tools Clear Linux or Mac System Logs Disable or Modify System Firewall

stealth

Rootkit Obfuscated Files or Information Software Packing Compile After Delivery Match Legitimate Resource Name or Location Portable Executable Injection File Deletion Timestomp Deobfuscate/Decode Files or Information Hidden Files and Directories Dynamic Linker Hijacking

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-10271HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2017-3066CRITICALEPSS 91%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

Rocke uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →