- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G0108 · 22 techniques
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0492 · blue-mockingbird
What it is
Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0108
Tools
The tools and malware families the sources tie to it.
- Blue Banana
- Cyber Eye RAT
- CyberGate
- FRP
- Mimikatz
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org