Loading threat actor…
Blue Mockingbird is a financially motivated threat actor associated with cryptocurrency-mining operations on compromised Windows servers. The group gains initial access by exploiting CVE-2019-18935 in Telerik UI for ASP.NET AJAX, enabling compromise through vulnerable public-facing applications. It deploys XMRig mining payloads and establishes persistence through Windows services and scheduled tasks on local and remote hosts. Blue Mockingbird uses Mimikatz to extract credentials from LSASS memory. It also uses Remote Desktop to access servers interactively and manually copy files to remote hosts, supporting lateral movement within compromised environments. Batch scripts automate payload execution and deployment. The group has obfuscated cryptocurrency wallet addresses embedded in its payload binaries to hinder analysis.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
78 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
13 malware families Mallory has associated with this actor across public reporting.
8 additional families tracked in Mallory.
10 CVEs Mallory has associated with this actor across public reporting. 10 of them are exploited in the wild (not necessarily by this actor).
4 more CVEs tied to this actor tracked in Mallory.
6 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.