Blue Mockingbird
Reports per quarter
Techniques seen in the last two years
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2014-2217
- CVE-2017-11317 KEV
- CVE-2017-11357 KEV ransomware
- CVE-2019-18935 KEV ransomware
- CVE-2020-1472 KEV ransomware
- CVE-2023-48788 KEV ransomware
- CVE-2024-1708 KEV ransomware
- CVE-2024-1709 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor 202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor 2021-Threat-Detection-Report
-
Microsoft IIS servers hacked by Blue Mockingbird to mine Monero
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Microsoft IIS servers hacked by Blue Mockingbird to mine Monero
-
Detecting COR_PROFILER manipulation for persistence
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting COR_PROFILER manipulation for persistence
-
Blue Mockingbird activity mines Monero cryptocurrency
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Blue Mockingbird activity mines Monero cryptocurrency
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Introducing Blue Mockingbird
Show all 11 reports Show fewer
-
Operation Cloud Hopper & RedLeaves
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Operation Cloud Hopper & RedLeaves
Newest first. Details opens the report in Explore.