- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- China(medium confidence)
- Motivation
- Financial gain
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0106 · 36 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0235 · rocke
ChinaWhat it is
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0106
- Other names
- Iron Group, Aged Libra, Iron Cyber Group, Rocke, Iron Group
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
Tools
The tools and malware families the sources tie to it.
- Androrat
- Archelaus Beta
- Backdoor.Oldrea
- Cyber Eye RAT
- CyberGate
- DroidJack
- Miner-C
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de