Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Rocke · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Rocke

  • Aged Libra

MITRE G0106 ↗

Rocke — ATT&CK roseRO

attack rose · 36 techniques across 10 tactics

Analyst brief

misp-galaxy + mitre-attack

This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability. In late July, we became aware that the same actor was engaged in another similar campaign. Through our investigation into this new campaign, we were able to uncover more details about the actor.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

36 techniques · 10 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    3 techniques

  3. Persistence

    3 techniques

  4. Stealth

    11 techniques

  5. Defense impairment

    4 techniques

  6. Credential access

    1 technique

  7. Discovery

    5 techniques

  8. Lateral movement

    1 technique

  9. Command and control

    6 techniques

  10. Impact

    1 technique

select a technique

CVEs Rocke is cited as exploiting

none on KEV
  1. CVE-2017-30662026-10-17
    1. “Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2017-102712026-10-17
    1. “Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “To deliver the malware to the victim machines, the Rocke group exploits vulnerabilities in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion. For example, by exploiting Oracle WebLogic vulnerability CVE-2017-10271 in Linux shown in Figure 1, a compromised Linux victim machine downloads backdoor 0720.bin and opens a shell.”

      cited as exploiting · source: unit42.paloaltonetworks.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

5 sources
  1. 1.blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html
  2. 2.unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection…
  3. 3.intezer.com/blog-technical-analysis-cryptocurrency-mining-war-on-t…
  4. 4.unit42.paloaltonetworks.com/atoms/agedlibra
  5. 5.attack.mitre.org/groups/G0106

Track Rocke on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.