Loading malware…
Blue Mockingbird is a financially motivated cryptocurrency-mining malware campaign best known for exploiting CVE-2019-18935 in Telerik UI for ASP.NET AJAX to compromise vulnerable internet-facing Windows servers. The operation has been associated with Monero mining activity and post-compromise deployment of cryptomining tooling. Its activity has been publicly linked to exploitation of enterprise web applications, particularly IIS-based environments, where remote code execution provides initial footholds on exposed servers. Blue Mockingbird is commonly characterized as a cryptomining-focused intrusion set rather than a traditional ransomware or espionage operation. High-confidence reporting ties it to exploitation of Telerik deserialization flaws for initial access and subsequent execution of cryptocurrency-mining payloads on Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Telerik User Interface (UI) for ASP.NET does not properly filter serialized input for malicious content... There were two malware campaigns associated with this vulnerability: Netwalker Ransomware and Blue Mockbird Monero Cryptocurrency-mining. | There were two malware campaigns associated with this vulnerability: Netwalker Ransomware and Blue Mockbird Monero Cryptocurrency-mining.
1 distinct technique documented for this family, organized by ATT&CK tactic.
“Cyber actors continue to exploit publicly known—and often dated—software vulnerabilities… Four of the most targeted vulnerabilities in 2020 affected remote work, VPNs, or cloud-based technologies.” / “CVE-2019-19781… exploitation enables the actors to perform unauthorized RCE on a target system.”
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.