Rocke'in the Net Flow
Summary: Unit 42 analyzed NetFlow data from December 2018 to June 16, 2019 and found that 28.1% of the cloud environments it surveyed had at least one fully established connection to a known Rocke command-and-control domain, with 20% of organizations maintaining hourly heartbeats consistent with Rocke TTPs. The China-based cryptomining group, also known as the Iron Group and SystemTen, has released a new tool called Godlua that can act as an agent for scripted operations including denial of service, network proxying, and two shell capabilities.
What you should know: Nearly three in ten cloud environments surveyed were talking to Rocke infrastructure, and some did so almost daily for months without apparent detection - a hardcoded IP alone, 104.238.151[.]101, accounted for 411 unique connections across four monitored organizations.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026