Talos has written widely about the issue of cryptomining malware and how organizations should protect systems against this threat. We continue to actively research developments in this threat through research that includes monitoring criminal forums and deploying honeypot systems to attract these threats. It is through these intelligence sources that the Chinese-speaking actor which we refer to as “Rocke” came to our attention.
Rocke actively engages in distributing and executing cryptomining malware using a varied toolkit that includes Git repositories, HttpFileServers (HFS), and myriad different payloads, including shell scripts, JavaScript backdoors, as well as ELF and PE miners.
This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability.
