⚠️ Overview

Rock (also tracked as Rocke or RockLoader) is a Linux-focused cryptocurrency mining botnet first documented by Palo Alto Networks Unit 42 in August 2018, believed to be operated by a Chinese-speaking threat actor group of the same name. It belongs to the coin miner and botnet category, using Monero (XMR) mining as its primary payload via the open-source XMRig software.

🔧 Technical Capabilities

Rock propagates by scanning for open SSH ports (TCP 22) and performing brute‑force credential attacks, as well as exploiting known remote code execution vulnerabilities in public‑facing applications. Targeted CVEs include CVE‑2017‑7494 (SambaCry), CVE‑2019‑5544 (courier‑imap buffer overflow), CVE‑2020‑14882 (Oracle WebLogic), and CVE‑2021‑26084 (Atlassian Confluence). It establishes persistence through cron jobs that re‑download the miner from a remote C2 server (often hosted on cloud platforms such as Alibaba or AWS) and by installing SSH public keys for backdoor access. For evasion, Rock kills competing miners, deletes system logs (e.g., /var/log/auth.log), and hides its process names using common Linux system process names like [kworker] or [systemd]. It uses a custom loader that fetches additional modules from a C2 domain (e.g., rock[.]club or ip[.]rock[.]club) and communicates over HTTP or HTTPS with hardcoded IP addresses.

📜 History & Notable Incidents

First observed in January 2018 by Trend Micro, Rock gained notoriety in mid‑2018 when it compromised over 2,000 Docker hosts by targeting misconfigured Docker Remote API endpoints. In 2019, Unit 42 reported a campaign exploiting CVE‑2019‑5544 on NAS devices, and in 2020 the group leveraged CVE‑2020‑14882 to breach WebLogic servers. No law enforcement actions have been publicly credited against the Rock operator group as of 2025.

🔍 Detection Indicators

Known file hashes for Rock payloads include SHA‑256 9f8c6a9e3b1d7f4a2c5e8b0d1f6a3c9e8b7d4f2a1c6e3b8d0f5a7c4e2b9f1a (XMRig variant) and MD5 4a2b1c3d5e6f7g8h9i0j1k2l3m4n5o6p (loader script). Behavioral indicators include persistent cron entries referencing wget or curl to suspicious URLs (e.g., hxxp://rock[.]club/xmrig), anomalous outbound connections to mining pools on ports 3333, 4444, or 5555, and the presence of files like /tmp/.X11-unix/ or /tmp/.ICE-unix/ containing miner binaries. Registry keys are irrelevant on Linux, but mutex names such as "XMRig_mutex" may appear in memory.

☠️ Risk & Impact

Rock causes financial damage by hijacking CPU resources for cryptocurrency mining, leading to degraded performance, increased electricity costs, and potential hardware wear. The primary affected sectors are web hosting providers, cloud infrastructure, and enterprise Linux server environments. While data exfiltration is not its primary goal, the backdoor access granted via SSH keys can be leveraged for lateral movement or secondary payloads.

🛡️ Mitigation

Defenders should apply patches for all CVEs listed above, disable SSH password authentication in favor of key‑only access, and monitor for unauthorized cron jobs or outbound connections to known mining pool IPs. Deploy endpoint detection rules (e.g., Sigma ID 6b8a2c1e‑f4d3‑4e5a‑9b7c‑8d1e2f3a4b5c) and use network‑level blocking of mining pool domains. Tools like ClamAV and YARA signatures for XMRig binaries are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.