Blue Mockingbird (G0108) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

CISA Known Exploited

About Blue Mockingbird

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

View MITRE record ↗

Techniques by Tactic (22)

Resource Development

T1588.002 Tool

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1569.002 Service ExecutionT1574.012 COR_PROFILER

Persistence

T1053.005 Scheduled TaskT1112 Modify RegistryT1543.003 Windows ServiceT1546.003 Windows Management Instrumentation Event Subscription

Privilege Escalation

T1053.005 Scheduled TaskT1134 Access Token ManipulationT1543.003 Windows ServiceT1546.003 Windows Management Instrumentation Event Subscription

Stealth

T1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1134 Access Token ManipulationT1218.010 Regsvr32T1218.011 Rundll32T1574.012 COR_PROFILER

Defence Impairment

T1112 Modify Registry

Credential Access

T1003.001 LSASS Memory

Discovery

T1082 System Information Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin Shares

Command & Control

T1090 Proxy

Impact

T1496.001 Compute Hijacking

Toolsets (2)

🔧

FRP S1144

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (1)

Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.

↑