Blue Mockingbird

G01080 reports from 0 vendors

[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)

Vendor aliases (1)

The same group is tracked under different names by different vendors.

Vendor	Name
Various	Blue Mockingbird

MITRE ATT&CK techniques (22)

T1003.001 T1021.001 T1021.002 T1027.013 T1036.005 T1047 T1053.005 T1059.001 T1059.003 T1082 T1090 T1112 T1134 T1190 T1218.010 T1218.011 T1496.001 T1543.003 T1546.003 T1569.002 T1574.012 T1588.002

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Blue Mockingbird, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Blue Mockingbird. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (2)

Open-source reports about this actor collected from MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G0108
redcanary.comhttps://redcanary.com/blog/blue-mockingbird-cryptominer/