Rocke
Rocke is a China-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance sector in 6 countries, including the United States and the United Kingdom. It uses 59 MITRE ATT&CK techniques and exploits 10 known CVEs.
- Iron Group
- Aged Libra
- G0106
- Origin
- China
- Techniques
- 59
- Exploited CVEs
- 10
- First seen
- Aug 1, 2018
- Last seen
- Sep 1, 2019
- Record updated
Who They Target.
About Rocke.
Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.