Illicit Cryptomining Threat Actor Rocke Changes Tactics, Now More Difficult to Detect

<h2>Summary</h2><p>Rocke, a China-based cryptomining threat actor, has changed its Command and Control (C2) infrastructure away from Pastebin to a self-hosted solution during the summer of 2019. The setup scripts were hosted on the domains “lsd.systemten[.]org” and “update.systemten[.]org” as pastes. In September 2019, the actor moved away from hosting the scripts on dedicated servers and instead started to use Domain Name System (DNS) text records. These records are accessed via normal DNS queries or DNS-over-HTTPs (DoH) if the DNS query fails. In addition to the C2 change, functionality was also added to their LSD malware to exploit ActiveMQ servers vulnerable to CVE-2016-3088.</p><p>The change in technique observed by Rocke is a step forward in regards to the threat actor’s overall sophistication. By moving from Pastebin to self-hosted and DNS records, the actor is better protected against potential takedowns, and its malicious operations may become more difficult to detect. As of this writing, Rocke is primarily known for cryptomining, however, it is possible for the actor to change payloads to something more damaging if Rocke wished to try to make illegal funds with a different technique. Therefore, it is paramount to take steps to mitigate the possibility of Rocke-styled campaigns.</p><h2>Introduction</h2><p>Rocke is primarily focusing on illicit cryptomining that is conducted on compromised machines. The group was first reported by Cisco Talos^[1] in August 2018, and Palo Alto’s Unit 42 has produced numerous reports^[2-4] on the group since then. Anomali’s Threat Research Team has been tracking the actor’s activity since March of 2019. Our report in March described how the actor started to use a malware written in Go (Golang) to set up and monitor the mining on the infected machine.^[5] We have been observing the threat actor continuing to use the same malware throughout the year. In April 2019, Confluence users posted reports on Atlassian’s support forum reporting infections of cryptominer.^[6] Rocke utilized CVE-2019-3396, which was disclosed the month before, to install its malware on vulnerable Confluence servers. The activity of the group continued for a few months with only minor changes to their Tactics, Techniques, and Procedures (TTPs).</p><h2>Summer 2019 activity</h2><p>In June, Rocke shifted its technique from using “Pastebin” to self-hosting the initial setup script. This was performed by using subdomains on the domain “systemten[.]org”, the domain name that is pointing to the mining pool/proxy used by the threat actor. Two of these subdomains are “lsd.systemten[.]org” and “update.systemten[.]org”. On July 29, 2019, both of these subdomains saw a huge spike in requests, according to data from Cisco Umbrella. The “update” subdomain was still being requested until September 17, 2019, when it stopped abruptly. Figures 1 and 2 below are showing both of these events. The “lsd” subdomain is still being requested as of writing.</p><p style="text-align: center;"><em><img alt="Data from Cisco Umbrella showing queries for “lsd.systemten[.]org” for a few days in July. A spike of over 20,000 queries per hour were recorded on July 29, 2019." src="https://cdn.filestackcontent.com/vk5vUVgtQMaKCLufSVvt"/><br/> Figure 1 - Data from Cisco Umbrella showing queries for “lsd.systemten[.]org” for a few days in July. A spike of over 20,000 queries per hour were recorded on July 29, 2019.</em></p><p style="text-align: center;"><em><img alt="Data from Cisco Umbrella showing how queries for “update.systemten[.]org” stopped on September 17, 2019." src="https://cdn.filestackcontent.com/Ylr3IwL5TQ654S4hFHMZ"/><br/> Figure 2 - Data from Cisco Umbrella showing how queries for “update.systemten[.]org” stopped on September 17, 2019.</em></p><p>The two subdomains shown above were substituting the actor’s use of Pastebin. The “update” subdomain returns the current version string. From it, the malware determines if it needs to download a newer version. The “lsd” subdomain serves the setup bash script, which is used to set up some persistence via cron jobs and download the latest version of the malware. </p><h3>Changes to the LSD malware</h3><p>The “LSD” malware has had some updates since it was first reported on by Anomali Threat Research team in March 2019. A reconstruction of the source code layout is shown below:</p><pre> Package github.com/hippies/LSD/LSDB: /root/go/src/github.com/hippies/LSD/LSDB File: <autogenerated> init Lines: 1 to 1 (0) File: a.go _kBytes Lines: 16 to 30 (14) KWR Lines: 30 to 37 (7) File: b.go _libBytes Lines: 14 to 21 (7) LibWrite Lines: 21 to 25 (4) File: c.go _netdnsinitBytes Lines: 11 to 18 (7) _netdnsserviceBytes Lines: 18 to 25 (7) NetdnsWrite Lines: 25 to 34 (9) Package github.com/hippies/LSD/LSDA: /root/go/src/github.com/hippies/LSD/LSDA File: <autogenerated> init Lines: 1 to 1 (0) File: a.go run Lines: 11 to 60 (49) runtwo Lines: 60 to 72 (12) Aago Lines: 72 to 82 (10) Aagofunc1 Lines: 77 to 80 (3) File: b.go generateTask Lines: 17 to 29 (12) cmd Lines: 29 to 56 (27) cmdfunc1 Lines: 37 to 73 (36) cmdtwo Lines: 56 to 68 (12) bgo Lines: 68 to 88 (20) bgofunc1 Lines: 73 to 76 (3) Bbgo Lines: 88 to 93 (5) File: c.go crun Lines: 12 to 48 (36) crunfunc1 Lines: 17 to 65 (48) cruntwo Lines: 48 to 60 (12) Ccgo Lines: 60 to 70 (10) Ccgofunc1 Lines: 65 to 68 (3) File: d.go exp Lines: 13 to 44 (31) expfunc1 Lines: 18 to 67 (49) drun Lines: 44 to 50 (6) druntwo Lines: 50 to 62 (12) Ddgo Lines: 62 to 77 (15) Ddgofunc1 Lines: 67 to 70 (3) Package github.com/hippies/LSD/LSDC: /root/go/src/github.com/hippies/LSD/LSDC File: <autogenerated> init Lines: 1 to 69 (68) File: a.go Read Lines: 24 to 44 (20) StartHttpServer Lines: 44 to 122 (78) StartHttpServerfunc1 Lines: 46 to 287 (241) glob.func1 Lines: 70 to 74 (4) glob.func2 Lines: 74 to 79 (5) glob.func3 Lines: 79 to 90 (11) glob.func4 Lines: 90 to 96 (6) Getcmdnums Lines: 122 to 151 (29) file2Pid Lines: 151 to 175 (24) Getmd5nums Lines: 175 to 214 (39) Mkdir Lines: 214 to 218 (4) Writefile Lines: 218 to 227 (9) Writefiletwo Lines: 227 to 255 (28) Chmod Lines: 255 to 261 (6) Delfile Lines: 261 to 270 (9) Changetime Lines: 270 to 278 (8) Cmdexec Lines: 278 to 284 (6) Checkupdate Lines: 284 to 311 (27) Checkupdatefunc1 Lines: 287 to 335 (48) Updatekill Lines: 311 to 332 (21) getip Lines: 332 to 364 (32) getipfunc1 Lines: 335 to 340 (5) getipb Lines: 364 to 379 (15) Getiplist Lines: 379 to 407 (28) Cron Lines: 407 to 422 (15) Bashrc Lines: 422 to 429 (7) File: b.go procPidStatSplit Lines: 12 to 61 (49) readSmallFile Lines: 61 to 74 (13) readFileLines Lines: 74 to 84 (10) readUInt Lines: 84 to 92 (8) getProcessCpu Lines: 92 to 102 (10) GetProcessCPUPercent Lines: 102 to 111 (9) Killcpu Lines: 111 to 118 (7) Package main: /root/go/src/github.com/hippies/LSD File: <autogenerated> init Lines: 1 to 1 (0) File: main.go attack Lines: 17 to 24 (7) main Lines: 24 to 33 (9)</autogenerated></autogenerated></autogenerated></autogenerated></pre><p>One new functionality is the addition of the “StartHttpServer” function. The malware starts a web server that is listening on localhost and TCP port 65533. This serves as a mutex to ensure only one instance of the malware is running because only one application can bind to a specific port. In Figure 3 below it can be seen that the malware tries to connect to this port. If it succeeds, it knows another version is running and it exits. Otherwise, it continues with setting up the machine for mining.</p><p style="text-align: center;"><em><img alt="Assembly snippet showing the malware connecting to localhost on port 65533 over TCP." src="https://cdn.filestackcontent.com/psbMSJEqTLyaIuz6yiTx"/><br/> Figure 3 - Assembly snippet showing the malware connecting to localhost on port 65533 over TCP.</em></p><h3>New Exploit Added</h3><p>The first iteration of the malware, would try to gain access to other machines via SSH and Redis. This was performed by using weak credentials. Later during the spring, functionality for exploiting Jenkins servers was also added. In this phase, support for CVE-2016-3088 exploitation was the important addition. CVE-2016-3088 is a vulnerability in ActiveMQ that can allow uploading of an arbitrary file. In Figure 4 it can be seen that the malware tries to upload a cron job to the following locations: “/etc/cron.d/root”, “/var/spool/cron/root”, and “/var/spool/cron/crontabs/root”.</p><p style="text-align: center;"><em><img alt="The LSD malware tries to add crontab files to “/etc/cron.d/root”, “/var/spool/cron/root”, and “/var/spool/cron/crontabs/root”." src="https://cdn.filestackcontent.com/FeBYLHvLQRWz1KUFyNYm"/><br/> Figure 4 - The LSD malware tries to add crontab files to “/etc/cron.d/root”, “/var/spool/cron/root”, and “/var/spool/cron/crontabs/root”.</em></p><p>The exploit is performed by using two HTTP requests. First, the file is uploaded via a “PUT” request as can be seen in Figure 5. The file is then moved to the location for a crontab file via a “MOVE” request, shown in Figure 6.</p><p style="text-align: center;"><em><img alt="LSD malware constructing a “PUT” request to upload the crontab file to “/fileserver/go.txt” on the ActiveMQ host." src="https://cdn.filestackcontent.com/haFIAI6aQu24buzQayf5"/><br/> Figure 5 - LSD malware constructing a “PUT” request to upload the crontab file to “/fileserver/go.txt” on the ActiveMQ host.</em></p><p style="text-align: center;"><em><img alt="The malware constructs a “MOVE” request to move the crontab file from “/fileserver/go.txt” to one of the three crontab locations." src="https://cdn.filestackcontent.com/EA0uIQB9T7OqoBWroJ89"/><br/> Figure 6 - The malware constructs a “MOVE” request to move the crontab file from “/fileserver/go.txt” to one of the three crontab locations.</em></p><h3>King of the Hill</h3><p>The malware tries to ensure only the threat actor’s miner is running on the infected machine. It does so by killing any other processes with high CPU usage. The LSD malware identifies its miner via the MD5 hash of the file to make sure it doesn’t kill its miner. In Figure 7 below it can be seen that the malware compares the MD5 hash to two hardcoded values. These hashes match the hashes of the 32-bit and the 64-bit version of the miner dropped by the malware.</p><p style="text-align: center;"><em><img alt="Screenshot showing the LSD malware comparing the MD5 hashes against two hardcoded values. The hardcoded values matches the hashes for the 32-bit and the 64-bit miner." src="https://cdn.filestackcontent.com/scmSxfRaQpOX20kukv3a"/><br/> Figure 7 - Screenshot showing the LSD malware comparing the MD5 hashes against two hardcoded values. The hardcoded values matches the hashes for the 32-bit and the 64-bit miner.</em></p><p>After the malware knows which process to ignore, it will iterate through all the running processes and capture the CPU usage. If it’s above the threshold, the process is killed as can be seen in Figure 8.</p><p style="text-align: center;"><em><img alt="The LSD malware gets the CPU usage of all running processes and kills all processes with high CPU usage." src="https://cdn.filestackcontent.com/kURVqoMIQjSkYwmTltzI"/><br/> Figure 8 - The LSD malware gets the CPU usage of all running processes and kills all processes with high CPU usage.</em></p><h2>September and DoH</h2><p>In September 2019, Rocke pushed a new version of the LSD malware. The malware maintains the functionality from the samples seen during the summer of 2019. A reconstruction of the source code layout is shown below:</p><pre> Package github.com/hippies/LSD/LSDB: /root/go/src/github.com/hippies/LSD/LSDB File: <autogenerated> init Lines: 1 to 1 (0) File: a.go _kBytes Lines: 15 to 29 (14) KWR Lines: 29 to 49 (20) File: b.go _libBytes Lines: 14 to 21 (7) LibWrite Lines: 21 to 25 (4) File: c.go _netdnsinitBytes Lines: 12 to 19 (7) _netdnsserviceBytes Lines: 19 to 26 (7) NetdnsWrite Lines: 26 to 39 (13) Package github.com/hippies/LSD/LSDA: /root/go/src/github.com/hippies/LSD/LSDA File: <autogenerated> init Lines: 1 to 1 (0) File: a.go run Lines: 11 to 65 (54) runtwo Lines: 65 to 77 (12) Aago Lines: 77 to 87 (10) Aagofunc1 Lines: 82 to 85 (3) File: b.go generateTask Lines: 17 to 29 (12) cmd Lines: 29 to 59 (30) cmdfunc1 Lines: 37 to 76 (39) cmdtwo Lines: 59 to 71 (12) bgo Lines: 71 to 91 (20) bgofunc1 Lines: 76 to 79 (3) Bbgo Lines: 91 to 96 (5) File: c.go crun Lines: 13 to 51 (38) crunfunc1 Lines: 18 to 68 (50) cruntwo Lines: 51 to 63 (12) Ccgo Lines: 63 to 73 (10) Ccgofunc1 Lines: 68 to 71 (3) File: d.go exp Lines: 13 to 46 (33) expfunc1 Lines: 18 to 69 (51) drun Lines: 46 to 52 (6) druntwo Lines: 52 to 64 (12) Ddgo Lines: 64 to 82 (18) Ddgofunc1 Lines: 69 to 72 (3) Package github.com/hippies/LSD/LSDC: /root/go/src/github.com/hippies/LSD/LSDC File: <autogenerated> init Lines: 1 to 69 (68) File: a.go Read Lines: 25 to 45 (20) StartHttpServer Lines: 45 to 91 (46) StartHttpServerfunc1 Lines: 47 to 203 (156) glob.func1 Lines: 71 to 75 (4) glob.func2 Lines: 75 to 80 (5) glob.func3 Lines: 80 to 97 (17) GetCurrentPath Lines: 91 to 128 (37) glob.func4 Lines: 97 to 101 (4) Getcmdnums Lines: 128 to 157 (29) file2Pid Lines: 157 to 181 (24) Getmd5nums Lines: 181 to 200 (19) Downloadfile Lines: 200 to 235 (35) Downloadfilefunc1 Lines: 203 to 398 (195) Update Lines: 235 to 293 (58) Dnstofile Lines: 293 to 308 (15) CopyFile Lines: 308 to 325 (17) Mkdir Lines: 325 to 329 (4) Writefile Lines: 329 to 338 (9) Writefiletwo Lines: 338 to 366 (28) Chmod Lines: 366 to 372 (6) Delfile Lines: 372 to 381 (9) Changetime Lines: 381 to 389 (8) Cmdexec Lines: 389 to 395 (6) Dnsget Lines: 395 to 431 (36) Dnsgetfunc1 Lines: 398 to 491 (93) Checkupdate Lines: 431 to 451 (20) Getcronurl Lines: 451 to 467 (16) Updatekill Lines: 467 to 488 (21) getip Lines: 488 to 520 (32) getipfunc1 Lines: 491 to 496 (5) getipb Lines: 520 to 535 (15) Getiplist Lines: 535 to 563 (28) Cron Lines: 563 to 578 (15) Bashrc Lines: 578 to 585 (7) File: b.go procPidStatSplit Lines: 12 to 61 (49) readSmallFile Lines: 61 to 74 (13) readFileLines Lines: 74 to 84 (10) readUInt Lines: 84 to 92 (8) getProcessCpu Lines: 92 to 102 (10) GetProcessCPUPercent Lines: 102 to 111 (9) Killcpu Lines: 111 to 118 (7) File: c.go NewAesCipher128 Lines: 16 to 52 (36) (*AesCipher128)BlockSize Lines: 52 to 67 (15) (*AesCipher128)Decrypt Lines: 67 to 71 (4) Package main: /root/go/src/github.com/hippies/LSD File: <autogenerated> init Lines: 1 to 1 (0) File: main.go attack Lines: 16 to 27 (11) lsd Lines: 27 to 79 (52) main Lines: 79 to 95 (16)</autogenerated></autogenerated></autogenerated></autogenerated></pre><p>The primary change is in the C2 functionality. Instead of using the domain “systemten[.]org” the threat actor has moved over to the domain “iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com”. According to Cisco Umbrella data, the “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com” subdomain, shown in Figure 9, started to be queried on September 17. This is the same day as when “update.systemten[.]org” stopped being queried.</p><p style="text-align: center;"><em><img alt="DNS queries for “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com” in September 2019. The requests are around 75 requests per hour." src="https://cdn.filestackcontent.com/ipDhjim5R0GRH59mYm9h"/><br/> Figure 9 - DNS queries for “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com” in September 2019. The requests are around 75 requests per hour.</em></p><p>Instead of hosting the setup script and update version on a dedicated host, the threat actor is using TXT records. In Figure 10 it can be seen that the malware tries to lookup the TXT record for “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com”. The response is encrypted with AES-128.</p><p style="text-align: center;"><em><img alt="Malware uses Go standard library package “net” to perform a lookup of the TXT record “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com”." src="https://cdn.filestackcontent.com/mFggBO2fSmmeGokvWKQr"/><br/> Figure 10 - Malware uses Go standard library package “net” to perform a lookup of the TXT record “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com”.</em></p><p>If the lookup fails, the malware tries to perform the same lookup via a DoH request, shown in Figure 11. The server queried for the DoH request is “cloudflare-dns.com”.</p><p style="text-align: center;"><em><img alt="LSD malware creating a DoH request for TXT records." src="https://cdn.filestackcontent.com/0NYnW0zjSsqpF37FAPpg"/><br/> Figure 11 - LSD malware creating a DoH request for TXT records.</em></p><p>The TXT record values are encrypted with 128-bit AES in cipher-block-chaining (CBC) mode and base64 encoded. The key is derived from the TXT record. Figure 12 shows a summary of the function used to derive the decryption key. The record, for example, “update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com” is hashed with two rounds of MD5. The 128-bit hash digest is passed to the Go standard library function for generating a new AES cipher. The key and block are added to the “LSDC.AesCipher128” struct, shown in Figure 13.</p><p style="text-align: center;"><em><img alt="Summary of the function used to generate the AES key to decrypt the TXT request answer." src="https://cdn.filestackcontent.com/GXAZmgfRuumyhmHYCWyw"/><br/> Figure 12 - Summary of the function used to generate the AES key to decrypt the TXT request answer.</em></p><p style="text-align: center;"><em><img alt="Data structure used to hold decryption information." src="https://cdn.filestackcontent.com/ZvXcodA3Tda9ibE2r97m"/><br/> Figure 13 - Data structure used to hold decryption information.</em></p><h2>Conclusion</h2><p>Rocke keeps evolving its TTPs in attempts to remain undetected. By moving away from hosting scripts on Pastebin to self-hosted and DNS records, the threat actor is more protected against potential take-downs that could prevent ongoing malicious activity. It is expected that the group will continue to exploit more vulnerabilities to mine additional cryptocurrencies in the near future. Enterprises with internet-facing services should ensure all the software is always up-to-date and that no weak passwords are used. While illicit cryptocurrency mining can be seen as a minor issue, it could lead to increased resource drain and earlier hardware failure. In addition, it is possible that Rocke, or other cryptomining threat actors could change the payload from a cryptominer to something more dangerous, such as ransomware or a Remote Access Trojan (RAT). Therefore, it is paramount to take steps to mitigate the possibility of Rocke-styled campaigns.</p><p>Enterprise Threatstream users can <a href="https://ui.threatstream.com/campaign/13819" target="_blank">access more information here</a>, which includes password lists used by the actor for brute force attacks.</p><h2>IOCs</h2><ul><li>systemten[.]org</li><li>lsd.systemten[.]org</li><li>update.systemten[.]org</li><li>1x32.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>2x32.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>3x32.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>1x64.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>2x64.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>3x64.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>shell.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>update.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li><li>cron.iap5u1rbety6vifaxsi9vovnc9jjay2l[.]com</li></ul><h2>MITRE ATT&amp;CK™ Techniques</h2><table class="table table-striped"><tbody><tr><th>Tactic</th><th>ID</th><th>Name</th><th>Description</th></tr><tr><td>Initial Access</td><td><a href="https://attack.mitre.org/techniques/T1190" target="_blank">T1190</a></td><td>Exploit Public-Facing Application</td><td>Rocke is using exploit known vulnerabilities in public facing services.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1078" target="_blank">T1078</a></td><td>Valid Accounts</td><td>The LSD malware uses stored ssh keys on the infected host to gain access to other machines.</td></tr><tr><td>Execution</td><td><a href="https://attack.mitre.org/techniques/T1168/" target="_blank">T1168</a></td><td>Local Job Scheduling</td><td>The exploits are used to install cron jobs that will download the LSD malware.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1064/" target="_blank">T1064</a></td><td>Scripting</td><td>The cron job will download a shell script that in turn downloads the LSD malware.</td></tr><tr><td>Persistence</td><td><a href="https://attack.mitre.org/techniques/T1156" target="_blank">T1156</a></td><td>.bash_profile and .bashrc</td><td>Entries to “.bashrc” is added to for persistence.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1168/" target="_blank">T1168</a></td><td>Local Job Scheduling</td><td>Cron job entries are created to ensure a new version of the LSD malware is installed in the case it is removed.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1501/" target="_blank">T1501</a></td><td>Systemd Service</td><td>The LSD malware creates a systemd service to ensure it is restarted when the machine reboots.</td></tr><tr><td>Defense Evasion</td><td><a href="https://attack.mitre.org/techniques/T1036/" target="_blank">T1036</a></td><td>Masquerading</td><td>The LSD malware use filenames similar to common Linux services. For example, sshd and kerberods.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1099/" target="_blank">T1099</a></td><td>Timestomp</td><td>Files created have their timestamp altered to appear older.</td></tr><tr><td>Credential Access</td><td><a href="https://attack.mitre.org/techniques/T1110" target="_blank">T1110</a></td><td>Brute Force</td><td>The LSD malware tries to compromise Redis and ssh servers via credential brute forcing.</td></tr><tr><td>Discovery</td><td><a href="https://attack.mitre.org/techniques/T1046" target="_blank">T1046</a></td><td>Network Service Scanning</td><td>The LSD malware scans for other machines that are running vulnerable services of ActiveMQ, Jenkins, ssh, and Redis.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1057" target="_blank">T1057</a></td><td>Process Discovery</td><td>The LSD malware enumerates all the running processes to find any other potential miners installed on the machine. If others are found, they are killed.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1018" target="_blank">T1018</a></td><td>Remote System Discovery</td><td>The setup script used by the threat actor uses the known_hosts file to find other machines it can access over ssh.</td></tr><tr><td>Lateral Movement</td><td><a href="https://attack.mitre.org/techniques/T1021" target="_blank">T1021</a></td><td>Remote Services</td><td>The setup script uses known ssh hosts and stored ssh keys to infect other machines.</td></tr><tr><td>Command and Control</td><td><a href="https://attack.mitre.org/techniques/T1043" target="_blank">T1043</a></td><td>Commonly Used Port</td><td>The LSD uses HTTP/HTTPs and DNS TXT records for C2.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1132" target="_blank">T1132</a></td><td>Data Encoding</td><td>The data retrieved from the DNS TXT records are encrypted and base64 encoded.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1079" target="_blank">T1079</a></td><td>Multilayer Encryption</td><td>The LSD malware uses DoH to retrieve encrypted instructions.</td></tr><tr><td> </td><td><a href="https://attack.mitre.org/techniques/T1071" target="_blank">T1071</a></td><td>Standard Application Layer Protocol</td><td>The LSD uses HTTP/HTTPs and DNS TXT records for C2.</td></tr><tr><td>Impact</td><td><a href="https://attack.mitre.org/techniques/T1496/" target="_blank">T1496</a></td><td>Resource Hijacking</td><td>The LSD malware installs a Monero miner.</td></tr></tbody></table><h2>Endnotes</h2><ol><li>David Liedenberg, “<a href="https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html" target="_blank">Rocke: The Champion of Monero Miners</a>,” Talos Blog, accessed March 14, 2019, published August 30, 2018.</li><li>Nathaniel Quist, “<a href="https://unit42.paloaltonetworks.com/rockein-the-netflow/" target="_blank">Rocke’in the NetFlow</a>”, Palo Alto Networks Unit 42 Blog, accessed October 8, 2019, published August 1, 2019.</li><li>Claud Xiao, Cong Zheng and Xingyu Jin, “<a href="https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/" target="_blank">Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows</a>”, Palo Alto Networks Unit 42 Blog, accessed October 8, 2019, published September 17, 2018.</li><li>Xingyu Jin and Claud Xiao, “<a href="https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/" target="_blank">Malware Used by “Rocke” Group Evolves to Evade Detection by Cloud Security Products</a>”, Palo Alto Networks Unit 42 Blog, accessed October 8, 2019, published January 17, 2019.</li><li>Anomali Labs, “<a href="https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang" target="_blank">Rocke Evolves Its Arsenal With a New Malware Family Written in Golang</a>”, Anomali Blog, accessed October 8, 2019, published March 15, 2019.</li><li>“<a href="https://community.atlassian.com/t5/Confluence-questions/How-come-my-confluence-installation-was-hacked-by-Kerberods/qaq-p/1054605" target="_blank">How come my Confluence installation was hacked by Kerberods malware?</a>”, Atlassian Community, accessed October 8, 2019, published Apr 10, 2019.</li></ol>