THREAT_ACTOR · G0106
Rocke
Also known as: Rocke
Profile
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.
MITRE ATT&CK ↗Techniques
36 ATT&CK techniques attributed to this actor.
T1014 RootkitT1018 Remote System DiscoveryT1021.004 SSHT1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.004 Compile After DeliveryT1036.005 Match Legitimate Resource Name or LocationT1037 Boot or Logon Initialization ScriptsT1046 Network Service DiscoveryT1053.003 CronT1055.002 Portable Executable InjectionT1057 Process DiscoveryT1059.004 Unix ShellT1059.006 PythonT1070.004 File DeletionT1070.006 TimestompT1071 Application Layer ProtocolT1071.001 Web ProtocolsT1082 System Information DiscoveryT1102 Web ServiceT1102.001 Dead Drop ResolverT1105 Ingress Tool TransferT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1222.002 Linux and Mac PermissionsT1496.001 Compute HijackingT1518.001 Security Software DiscoveryT1543.002 Systemd ServiceT1547.001 Registry Run Keys / Startup FolderT1552.004 Private KeysT1564.001 Hidden Files and DirectoriesT1571 Non-Standard PortT1574.006 Dynamic Linker HijackingT1685 Disable or Modify ToolsT1685.006 Clear Linux or Mac System LogsT1686 Disable or Modify System Firewall
Related corpus activity
10,205 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Rocke.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
Showing the top 30 by severity of 10,205.