Rocke: The Champion of Monero Miners

Summary: Cisco Talos researchers describe Rocke, a threat actor distributing cryptomining malware through Git repositories on gitee.com and gitlab.com, open HFS servers, and exploits for Apache Struts, Oracle WebLogic (CVE-2017-10271) and Adobe ColdFusion (CVE-2017-3066). The actor's XMRig and XMR-stak configs point to the MinerGate pool xmr[.]pool[.]MinerGate[.]com:45700 with the wallet rocke@live.cn, and Talos assesses with high confidence that Rocke operates from Jiangxi Province.
Bottom line: Rocke's toolkit includes a script that kills competing miners, uninstalls Chinese AV, and SSHes into hosts listed in known_hosts, so an infected machine becomes a launch point for the next one. The $14 Monero Silent Miner it deploys injects into notepad.exe to reach the mining pool, which means the process talking to MinerGate on your network may look like a text editor.

Read the original at Cisco Talos ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2017-10271 CVE-2017-3066
Related: Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters Cyber Risks ·
Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products Cyber Risks ·
Pro-Ocean: Rocke Group’s New Cryptojacking Malware Cyber Risks ·