Threat actor · all actors

RockeG0106 unknown

aka Rocke

Last updated: 2026-07-03

0attributed CVEs

50ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	33 / 50	66%
`CM-6`	31 / 50	62%
`CM-2`	27 / 50	54%
`SI-3`	25 / 50	50%
`AC-3`	23 / 50	46%
`CA-7`	23 / 50	46%
`AC-2`	22 / 50	44%
`AC-6`	22 / 50	44%
`CM-7`	21 / 50	42%
`SI-7`	21 / 50	42%
`AC-5`	17 / 50	34%
`CM-5`	16 / 50	32%
`IA-2`	16 / 50	32%
`SC-7`	12 / 50	24%
`AC-17`	11 / 50	22%

Co-occurring actors

None.