Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.1
- Talos Rocke August 2018
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Rocke | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1014 | Rootkit | — |
| T1018 | Remote System Discovery | — |
| T1021.004 | SSH | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1027.004 | Compile After Delivery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1046 | Network Service Discovery | — |
| T1053.003 | Cron | — |
| T1055.002 | Portable Executable Injection | — |
| T1057 | Process Discovery | — |
| T1059.004 | Unix Shell | — |
| T1059.006 | Python | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1102 | Web Service | — |
| T1102.001 | Dead Drop Resolver | — |
| T1105 | Ingress Tool Transfer | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1496.001 | Compute Hijacking | — |
| T1518.001 | Security Software Discovery | — |
| T1543.002 | Systemd Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.004 | Private Keys | — |
| T1564.001 | Hidden Files and Directories | — |
| T1571 | Non-Standard Port | — |
| T1574.006 | Dynamic Linker Hijacking | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
Rocke
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.