Rocke

Rocke is a cryptojacking threat group focused on compromising Linux and cloud-hosted environments to deploy Monero mining malware. The group has been associated with cloud-targeted campaigns since at least 2019 and is also referred to as Iron Group. Its operations emphasize monetization through illicit cryptocurrency mining rather than espionage or destructive effects. Rocke commonly targets exposed or weakly secured internet-facing services and cloud workloads, including vulnerable enterprise applications and misconfigured infrastructure. Reported intrusion vectors and propagation methods include exploitation of Apache ActiveMQ via CVE-2016-3088, Oracle WebLogic via CVE-2017-10271, Jenkins via CVE-2018-1000861 and CVE-2019-1003000, unsecured Redis instances, and brute-force activity against SSH and Redis. The group has shown particular interest in cloud environments associated with Chinese providers such as Alibaba Cloud and Tencent Cloud. Operationally, Rocke uses staged shell-script infection chains to download and execute additional payloads, often with redundant retrieval paths and public code-hosting or paste services for resilience. The group has also used compile-after-delivery tradecraft, delivering malware as C source files and compiling them locally with GCC. Payloads have included Go-based loaders and managers, Python-based loader stages, and XMRig-derived mining components. Rocke malware has been observed extracting compressed archives, embedding or unpacking miner components, and using modified UPX-style packing markers such as LSD! to hinder static detection. Persistence and stealth are central to Rocke operations. The group establishes persistence through cron jobs, boot-time services, and in some cases startup-folder artifacts on Windows. On Linux, Rocke has deployed LD_PRELOAD-based userland rootkit functionality, including libprocesshider-style capabilities, to conceal files, processes, network activity, and resource consumption. Malware associated with the group can falsify process or CPU-related information returned to monitoring tools. Rocke also performs process discovery and system profiling, including collecting kernel or architecture information with uname -m and identifying running process IDs. Rocke routinely removes competing miners and other malware, deletes artifacts, and attempts to disable or uninstall defensive tooling. Reported behavior includes terminating rival mining processes, uninstalling antivirus or cloud monitoring agents, and disabling host firewall controls in some campaigns. Lateral movement and worm-like propagation have also been documented through subnet scanning, exploitation of adjacent systems, and attempts to reuse SSH keys or trust relationships to spread within cloud environments. The group’s known capabilities include initial access through exploitation and brute force, reconnaissance and scanning of local or internet-reachable targets, persistence, defense evasion through rootkit-style hiding and packing changes, post-exploitation payload staging, and cryptocurrency theft via unauthorized mining.