FORENSIA

THREAT_ACTOR · G0108

Blue Mockingbird

Also known as: Blue Mockingbird

Profile

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.

MITRE ATT&CK ↗

Techniques

22 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1027.013 Encrypted/Encoded FileT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1082 System Information DiscoveryT1090 ProxyT1112 Modify RegistryT1134 Access Token ManipulationT1190 Exploit Public-Facing ApplicationT1218.010 Regsvr32T1218.011 Rundll32T1496.001 Compute HijackingT1543.003 Windows ServiceT1546.003 Windows Management Instrumentation Event SubscriptionT1569.002 Service ExecutionT1574.012 COR_PROFILERT1588.002 Tool

Software

2 malware/tools attributed to this actor.

MimikatzFRP

Related corpus activity

9,453 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Blue Mockingbird.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2026-4368cveransomware851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2024-1781cve—851
cve-2014-2321cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2025-34054cve—854
cve-2022-47945cve—851
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2025-2492cve—852
cve-2016-5681cve—852
cve-2025-23304cve—852
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,453.