Threat actor · G0108

Blue Mockingbird

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

ATT&CK techniques

22 mapped

T1003.001 T1021.001 T1021.002 T1027.013 T1036.005 T1047 T1053.005 T1059.001 T1059.003 T1082 T1090 T1112 T1134 T1190 T1218.010 T1218.011 T1496.001 T1543.003 T1546.003 T1569.002 T1574.012 T1588.002