Blue MockingbirdThreat actor
Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.From MITRE ATT&CK
Last reported 27 days ago, by AhnLab ASEC1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1505.003Web Shell
“Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability“2020, Red Canary disclosed a vulnerability attack case in which the Blue Mockingbird threat actor exploited the CVE-2019-18935 vulnerability to execute a malicious DLL on a Windows IIS server and conduct Monero cryptocurrency malware distribution.”
Indicators in its reports
named in the reports above- hxxp://65.98.5[.]158:31337/Ins.Txtin 1 report
- 65.98.5[.]158in 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendMessagein 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendDocumentin 1 report
- 0a4be0b6c650ffdcd1c22db56f1c4aecin 1 report
- 10f705728d228ad949b7894c1a85a2b1in 1 report
- 177e34d9174766a1d187a0c82de4c02fin 1 report
- 18fb4e070653fc9791e0e408d8cb1c8ein 1 report
- 1dbfda02d74b6a7586c4430175204c28in 1 report
- hxxp://2.59.133[.]147:31338/ins.txtin 1 report
- 2.59.133[.]147in 1 report
- hxxp://2.59.133[.]147:31338/sm.jsonin 1 report
- hxxp://206.82.6[.]22/in 1 report
- 206.82.6[.]22in 1 report
- hxxp://45.138.16[.]187:31337/bb.jsonin 1 report
- 45.138.16[.]187in 1 report
- hxxp://45.138.16[.]187:31337/cofuz.jsonin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.