Rocke
Rocke is a financially motivated threat actor, also referenced in the content as the Iron Cybercrime Group. The group has been associated with opportunistic attacks on Linux servers and with use of Linux.NOODLERAT for financial gain. Reported tradecraft in the provided content includes downloading payloads with wget and curl from Pastebin over HTTPS, extracting tar.gz archives from C2 infrastructure, and deploying a file named "libprocesshider" to hide files on infected systems. Rocke has used systemd service persistence on Linux, including adding a service so Golang-based payloads execute on boot. The actor has used uname -m to collect kernel and system information, detected running process PIDs on infected machines, deleted files on compromised hosts, changed timestamps of files, and used scripts to detect and uninstall antivirus software. The content also attributes UPX packing and UPX header modification to Rocke, including creation of UPX-packed files in the Windows Start Menu folder and modification of UPX headers to break unpackers. Known alias in the provided content: rocke; also referenced as Iron Cybercrime Group.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.
Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.
Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
5 more CVEs tied to this actor tracked in Mallory.
Observables
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Referenced as a threat actor associated with the Hidden Files and Directories defense evasion technique (T1564.001).
Listed as a threat actor associated with the detection for Metasploit-based Atlassian Confluence exploitation activity.
Referenced in the detection annotations as a threat actor associated with reconnaissance/exploitation behavior relevant to Netspy-style network scanning.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.