MalwareUsed by 1 actorExploits 2 CVEs

Pro-Ocean

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2017-10271Oracle WebLogic WLS-WSAT XMLDecoder Deserialization RCEExploited in the wild

In our analysis, we found Pro-Ocean targeting... Oracle WebLogic (CVE-2017-10271)... The list of vulnerable software that Pro-Ocean exploits includes: Oracle WebLogic – CVE-2017-10271. | We’ve named the malware Pro-Ocean after the name the attacker chose for the installation script. Pro-Ocean uses known vulnerabilities to target cloud applications.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

CVE-2016-3088Authenticated arbitrary file upload and RCE in Apache ActiveMQ FileserverExploited in the wild

In our analysis, we found Pro-Ocean targeting Apache ActiveMQ (CVE-2016-3088)... The list of vulnerable software that Pro-Ocean exploits includes: Apache ActiveMQ – CVE-2016-3088. | We’ve named the malware Pro-Ocean after the name the attacker chose for the installation script. Pro-Ocean uses known vulnerabilities to target cloud applications.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Rocke Group

We’ve named the malware Pro-Ocean after the name the attacker chose for the installation script. Pro-Ocean uses known vulnerabilities to target cloud applications.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

Pro-Ocean uses known vulnerabilities to target cloud applications. In our analysis, we found Pro-Ocean targeting Apache ActiveMQ (CVE-2016-3088), Oracle WebLogic (CVE-2017-10271) and Redis (unsecure instances).

Execution

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1574.006Dynamic Linker HijackingEvidence1

The hiding module is responsible for concealing Pro-Ocean’s malicious activity. It uses a native Linux feature, LD_PRELOAD... During execution, the hiding module compiles a C file into a library and adds it to /etc/ld.so.preload.

Persistence

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1543.002Systemd ServiceEvidence1

Pro-Ocean will try to gain persistence by copying itself into numerous locations, create a new malicious service that will execute the malware in case it is not running...

Privilege Escalation

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1543.002Systemd ServiceEvidence1

Pro-Ocean will try to gain persistence by copying itself into numerous locations, create a new malicious service that will execute the malware in case it is not running...

Stealth

6 techniques

T1014RootkitEvidence1

Here, we uncover a revised version of the same cloud-targeted cryptojacking malware, which now includes new and improved rootkit and worm capabilities.

T1027Obfuscated Files or InformationEvidence1

The miner seeks to hide using several obfuscation layers on top of the malicious code... The modules are gzipped inside the unpacked binary.

T1027.002Software PackingEvidence1

The binary is packed using UPX... However, in this case, the UPX magic string has been deleted from the binary, and therefore, static analysis tools cannot identify this binary as UPX and unpack it.

T1036MasqueradingEvidence1

Although Pro-Ocean attempts to disguise itself as benign, it packs an XMRig miner...

T1070Indicator RemovalEvidence1

Erase all of the cron tasks to make sure that other malware will not be able to recover.

T1574.006Dynamic Linker HijackingEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

Disable the iptables firewall so that the malware will have full access to the internet.

T1046Network Service DiscoveryEvidence1

This script retrieves the machine’s public IP by accessing an online service that does so in the address "ident.me" and then tries to infect all the machines in the same 16-bit subnet (e.g. 10.0.X.X). It does this by blindly executing public exploits one after the other in the hope of finding unpatched software it can exploit.

T1057Process DiscoveryEvidence1

It does this by running the “grep” command searching for other processes and network connections and then terminates them if found.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Look for SSH keys and attempt to use them in order to infect new machines.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Once it finds unpatched software and exploits it, the Python script sends a payload that will download an installation script from a malicious HTTP server... After laying the groundwork, the installation script will determine the machine CPU architecture and try to download the corresponding binary using various tools including curl, wget, python2, python3 and PHP.

Impact

2 techniques

T1489Service StopEvidence1

Attempt to remove other malware and miners including Luoxk, BillGates, XMRig, Hashfish and more... Once found, it kills them. ... This script loops forever and searches for processes that utilize more than 30% of the CPU... Once found, it kills them.

T1496Resource HijackingEvidence1

Its goal is to mine Monero into the attacker’s wallet, and it does so by deploying an XMRig miner 5.11.1 and a JSON configuration, then starting to mine.

Other

1 technique

T1562Impair DefensesEvidence1

In the case that the malware runs in Tencent Cloud or Alibaba Cloud, it will use the exact code of the previous malware to uninstall monitoring agents to avoid detection.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

palo alto networks unit 42 blogNews

Mar 26, 2021

20 Million Miners: Finding Malicious Cryptojacking Images in Docker Hub

Referenced as a prior example of Monero-focused cryptojacking activity.

palo alto networks unit 42 blogNews

Jan 28, 2021

Pro-Ocean: Rocke Group’s New Cryptojacking Malware

Cloud-targeted cryptojacking malware used by the Rocke Group to mine Monero. It includes four modules for hiding/rootkit behavior, mining, worm-like infection, and watchdog persistence. It targets Apache ActiveMQ, Oracle WebLogic, and insecure Redis instances, attempts lateral spread across local subnets, removes competing miners, disables defenses, and uses LD_PRELOAD-based process/file hiding plus persistence mechanisms such as services and cron jobs.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 2 CVEs

Pro-Ocean

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2017-10271Oracle WebLogic WLS-WSAT XMLDecoder Deserialization RCEExploited in the wild

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

CVE-2016-3088Authenticated arbitrary file upload and RCE in Apache ActiveMQ FileserverExploited in the wild

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Rocke Group

We’ve named the malware Pro-Ocean after the name the attacker chose for the installation script. Pro-Ocean uses known vulnerabilities to target cloud applications.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence1

Execution

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1574.006Dynamic Linker HijackingEvidence1

Persistence

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1543.002Systemd ServiceEvidence1

Pro-Ocean will try to gain persistence by copying itself into numerous locations, create a new malicious service that will execute the malware in case it is not running...

Privilege Escalation

2 techniques

T1053.003CronEvidence1

...and add several cron jobs that will do the same thing periodically.

T1543.002Systemd ServiceEvidence1

Pro-Ocean will try to gain persistence by copying itself into numerous locations, create a new malicious service that will execute the malware in case it is not running...

Stealth

6 techniques

T1014RootkitEvidence1

Here, we uncover a revised version of the same cloud-targeted cryptojacking malware, which now includes new and improved rootkit and worm capabilities.

T1027Obfuscated Files or InformationEvidence1

The miner seeks to hide using several obfuscation layers on top of the malicious code... The modules are gzipped inside the unpacked binary.

T1027.002Software PackingEvidence1

The binary is packed using UPX... However, in this case, the UPX magic string has been deleted from the binary, and therefore, static analysis tools cannot identify this binary as UPX and unpack it.

T1036MasqueradingEvidence1

Although Pro-Ocean attempts to disguise itself as benign, it packs an XMRig miner...

T1070Indicator RemovalEvidence1

Erase all of the cron tasks to make sure that other malware will not be able to recover.

T1574.006Dynamic Linker HijackingEvidence1

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

Disable the iptables firewall so that the malware will have full access to the internet.

T1046Network Service DiscoveryEvidence1

T1057Process DiscoveryEvidence1

It does this by running the “grep” command searching for other processes and network connections and then terminates them if found.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Look for SSH keys and attempt to use them in order to infect new machines.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Impact

2 techniques

T1489Service StopEvidence1

T1496Resource HijackingEvidence1

Its goal is to mine Monero into the attacker’s wallet, and it does so by deploying an XMRig miner 5.11.1 and a JSON configuration, then starting to mine.

Other

1 technique

T1562Impair DefensesEvidence1

In the case that the malware runs in Tencent Cloud or Alibaba Cloud, it will use the exact code of the previous malware to uninstall monitoring agents to avoid detection.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

palo alto networks unit 42 blogNews

Mar 26, 2021

20 Million Miners: Finding Malicious Cryptojacking Images in Docker Hub

Referenced as a prior example of Monero-focused cryptojacking activity.

palo alto networks unit 42 blogNews

Jan 28, 2021

Pro-Ocean: Rocke Group’s New Cryptojacking Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.