Rocke

Rocke is a Linux-focused opportunistic cryptojacking threat actor associated with cloud and server intrusions, especially the deployment of cryptocurrency miners on exposed or weakly secured systems. The group is widely linked to the KORKERDS cryptomining ecosystem and has been observed targeting Linux servers through exploitation of public-facing applications and post-compromise shell-based tooling. Rocke is known for using Unix shell scripts extensively for payload delivery, execution, and system modification, and for evolving from simple script-based miners to Golang-based payloads with more durable persistence mechanisms. Rocke commonly establishes persistence through cron-based scheduled execution and system startup mechanisms, including boot-time autostart via systemd services. Reported tradecraft includes placing or modifying scheduled tasks in common cron locations and ensuring miner payloads relaunch after reboot. The actor has also been associated with privileged container abuse in Linux environments and with post-exploitation behaviors on compromised hosts. Operationally, Rocke performs host discovery and environment profiling, including collecting kernel and architecture information. The group has been observed downloading additional tooling, extracting compressed archives, retrieving payloads over HTTP or HTTPS with standard command-line utilities, and using stealth measures such as masquerading and packed binaries. Rocke has also used rootkit-like userland hiding components and scripts that detect and uninstall antivirus software, reflecting a strong emphasis on defense evasion and maintaining exclusive access to compromised resources. Rocke’s activity is primarily financially motivated, with the objective of illicit cryptocurrency mining rather than espionage or destructive effects. The actor is notable for Linux persistence, miner deployment, security-tool removal, and opportunistic exploitation at scale.