{
  "id": "rocke",
  "name": "Rocke",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Alleged Chinese-speaking cryptojacking group",
      "src": [
        "mitre-g0106"
      ],
      "conf": "medium"
    },
    {
      "k": "attack_id",
      "v": "G0106",
      "src": [
        "mitre-g0106"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 36,
      "src": [
        "mitre-g0106"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address \"rocke@live.cn\" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0106)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/rocke.html",
  "sources": {
    "mitre-g0106": {
      "title": "Rocke, Group G0106",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0106/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}