H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)

24 recorded

Relationships

uses

to Access Token Manipulation

Technique

uses

to Compute Hijacking

Technique

uses

to COR_PROFILER

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to FRP

Tool

uses

to LSASS Memory

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

Technique

uses

to Remote Desktop Protocol

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Service Execution

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

G0108

RedCanary Mockingbird May 2020

https://redcanary.com/blog/blue-mockingbird-cryptominer/