SYMBOLCOMMON_NAMEaka. SYNONYMS

Rocke  (Back to overview)

aka: Aged Libra

This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability. In late July, we became aware that the same actor was engaged in another similar campaign. Through our investigation into this new campaign, we were able to uncover more details about the actor.

Associated Families
elf.kerberods elf.pro_ocean
References
2022-07-18 ⋅ Palo Alto Networks Unit 42 ⋅ Unit 42
Aged Libra
Xbash Rocke
2021-02-03 ⋅ Seguranca Informatica ⋅ Pedro Tavares
New cryptojacking malware called Pro-Ocean is now attacking Apache, Oracle and Redis servers
Pro-Ocean
2021-01-28 ⋅ Palo Alto Networks Unit 42 ⋅ Aviv Sasson
Pro-Ocean: Rocke Group’s New Cryptojacking Malware
Pro-Ocean
2019-09-11 ⋅ Talos Intelligence ⋅ Luke DuCharme, Paul Lee
Watchbog and the Importance of Patching
kerberods
2019-05-28 ⋅ Fortinet ⋅ Joie Salvio
Threat Research: New Rocke Variant Ready to Box Any Mining Challengers
kerberods
2019-05-09 ⋅ Intezer ⋅ Ignacio Sanmillan
Technical Analysis: Pacha Group Competing against Rocke Group for Cryptocurrency Mining Foothold on the Cloud
GreedyAntd Pacha Group Rocke
2019-05-07 ⋅ SANS ISC InfoSec Forums ⋅ Renato
Vulnerable Apache Jenkins exploited in the wild
kerberods
2019-05-07 ⋅ Trend Micro ⋅ Augusto Remillano II, Robert Malagad
CVE-2019-3396 Redux: Confluence Vulnerability Exploited to Deliver Cryptocurrency Miner With Rootkit
kerberods
2019-03-15 ⋅ Anomali ⋅ Threat Research Team
Rocke Evolves Its Arsenal With a New Malware Family Written in Golang
kerberods
2019-01-17 ⋅ Palo Alto Networks Unit 42 ⋅ Claud Xiao, Xingyu Jin
Malware Used by “Rocke” Group Evolves to Evade Detection by Cloud Security Products
Rocke
2018-08-30 ⋅ Cisco Talos ⋅ David Liebenberg
Rocke: The Champion of Monero Miners
Rocke
Credits: MISP Project