Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Blue Mockingbird · Unknown · mitre-attack · refreshed 2026-10-06

Blue Mockingbird

MITRE G0108 ↗

Blue Mockingbird — ATT&CK roseBM

attack rose · 22 techniques across 12 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2019-18935

Analyst brief

mitre-attack

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

22 techniques · 12 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    1 technique

  3. Execution

    5 techniques

  4. Persistence

    1 technique

  5. Privilege escalation

    1 technique

  6. Stealth

    6 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    1 technique

  9. Discovery

    1 technique

  10. Lateral movement

    2 techniques

  11. Command and control

    1 technique

  12. Impact

    1 technique

select a technique

Arsenal

2 tools
Tools
Tools · 2ATT&CK
FRPS1144 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to Blue Mockingbird

1 on CISA KEV
  1. CVE-2019-18935KEV2026-09-27
    1. “2020, Red Canary disclosed a vulnerability attack case in which the Blue Mockingbird threat actor exploited the CVE-2019-18935 vulnerability to execute a malicious DLL on a Windows IIS server and conduct Monero cryptocurrency malware distribution.”

      attributed by a report · source: asec.ahnlab.com ↗ · 2026-10-17

    2. “In at least two incident response (IR) engagements, Blue Mockingbird has exploited public-facing web applications ( T1190: Exploit Public-Facing Application ) that implemented Telerik UI for ASP.NET AJAX. This suite of user interface components accelerates the web development process, but some versions are susceptible to a deserialization vulnerability, CVE-2019-18935 .”

      cited as exploiting · source: redcanary.com ↗ · 2026-10-17

    3. “Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

2 sources
  1. 1.attack.mitre.org/groups/G0108
  2. 2.redcanary.com/blog/blue-mockingbird-cryptominer

Track Blue Mockingbird on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.