Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
11 malware familiesExploits CVEs in the wild

Blue Mockingbird

Also known asBlue Mockingbird

Blue Mockingbird is a threat actor associated in the provided content with cryptocurrency mining activity, specifically deployment of XMRIG packaged as a DLL. The content describes the actor using multiple persistence mechanisms, including Windows Scheduled Tasks, modification of existing services, creation of new services, and abuse of .NET COR_PROFILER via machine-scope environment variables to force .NET processes to load a malicious profiler DLL. Red Canary reported observing this COR_PROFILER abuse in multiple incident response engagements and noted Blue Mockingbird used wmic.exe to set COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH for persistence. The actor is described as making XMRIG persistent as a Windows service and using additional persistence through registry modifications that specify a DLL payload. Blue Mockingbird also used batch scripts to automate payload deployment and execution, PowerShell reverse TCP shells for interactive command execution, and Remote Desktop to log on to servers interactively and manually copy files to remote hosts. The content states the actor obtained and used Mimikatz, collected victim hardware details including CPU and memory information, obfuscated the wallet address in the payload binary, and masqueraded its XMRIG payload as wercplsupporte.dll to resemble the legitimate wercplsupport.dll file. The provided content does not attribute Blue Mockingbird to a specific nation state. No additional aliases or sub-groups beyond "blue_mockingbird" are directly supported in the content.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

12 of 15 tactics66 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
2 techniques
T1588
Obtain Capabilities
T1588.002×2
Tool
T1608×2
Stage Capabilities
T1608.001
Upload Malware
T1608.002
Upload Tool
TA0001
Initial Access
1 technique
T1190×10
Exploit Public-Facing Application
TA0002
Execution
6 techniques
T1047
Windows Management Instrumentation
T1053×2
Scheduled Task/Job
T1053.005×4
Scheduled Task
T1059
Command and Scripting Interpreter
T1059.001×10
PowerShell
T1059.003×3
Windows Command Shell
T1129
Shared Modules
T1569
System Services
T1569.002
Service Execution
T1574
Hijack Execution Flow
T1574.012
COR_PROFILER
TA0003
Persistence
6 techniques
T1053×2
Scheduled Task/Job
T1053.005×4
Scheduled Task
T1112×13
Modify Registry
T1137
Office Application Startup
T1505
Server Software Component
T1505.003×2
Web Shell
T1505.004
IIS Components
T1543
Create or Modify System Process
T1543.003×4
Windows Service
T1546
Event Triggered Execution
T1546.003
Windows Management Instrumentation Event Subscription
TA0004
Privilege Escalation
4 techniques
T1053×2
Scheduled Task/Job
T1053.005×4
Scheduled Task
T1484
Domain or Tenant Policy Modification
T1484.001
Group Policy Modification
T1543
Create or Modify System Process
T1543.003×4
Windows Service
T1546
Event Triggered Execution
T1546.003
Windows Management Instrumentation Event Subscription
TA0005
Stealth
4 techniques
T1027×3
Obfuscated Files or Information
T1036
Masquerading
T1218
System Binary Proxy Execution
T1218.010
Regsvr32
T1218.011×3
Rundll32
T1574
Hijack Execution Flow
T1574.012
COR_PROFILER
TA0112
Defense Impairment
2 techniques
T1112×13
Modify Registry
T1484
Domain or Tenant Policy Modification
T1484.001
Group Policy Modification
TA0006
Credential Access
3 techniques
T1003×3
OS Credential Dumping
T1003.001
LSASS Memory
T1187
Forced Authentication
T1557
Adversary-in-the-Middle
T1557.001
Name Resolution Poisoning and SMB Relay
TA0007
Discovery
4 techniques
T1012
Query Registry
T1018
Remote System Discovery
T1082×4
System Information Discovery
T1518
Software Discovery
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.001×4
Remote Desktop Protocol
T1021.002×2
SMB/Windows Admin Shares
TA0009
Collection
2 techniques
T1005
Data from Local System
T1557
Adversary-in-the-Middle
T1557.001
Name Resolution Poisoning and SMB Relay
TA0011
Command and Control
3 techniques
T1090×3
Proxy
T1090.001×2
Internal Proxy
T1090.004
Domain Fronting
T1102
Web Service
T1105
Ingress Tool Transfer
WEAPONIZED

Associated vulnerabilities

10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.

CVE-2019-18935RCE in Progress Telerik UI for ASP.NET AJAX RadAsyncUploadIn the wildEvidence2

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

CVE-2021-31207Post-auth Arbitrary File Write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34473ProxyShell pre-auth SSRF in Microsoft Exchange AutodiscoverIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34523Microsoft Exchange PowerShell Backend Elevation of Privilege (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

5 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping42

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal11

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs10

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables6

Domains, IPs, and hashes tied to this actor, refreshed continuously.