Blue Mockingbird is the name we’ve given to a cluster of similar activity we’ve observed involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. Gaining entry . In at least two incident response (IR) engagements, Blue Mockingbird has exploited public-facing web applications (T1190: Exploit Public-Facing Application) that implemented Telerik UI for ASP.NET AJAX. The exploitation of this CVE is not unique to Blue Mockingbird, but it has been a common point of entry. In telemetry, investigators will notice w3wp.exe writing the DLLs to disk and then immediately loading them into memory afterward. Execution and evasion . The primary payload distributed by Blue Mockingbird is a version of XMRIG packaged as a DLL. Come for the exploit, stay for the mining . Blue Mockingbird leveraged multiple techniques for persistence during incidents. It executed the following command: Since COR_PROFILER was configured, every process that loaded the Microsoft .NET Common Language Runtime would execute the command above, re-establishing persistence. In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These were accompanied by cleartext references to command-line options common to XMRIG: The final piece of evidence came from a text log written to disk by some versions of the miner DLL. So far, we’ve identified two wallet addresses used by Blue Mockingbird that are in active circulation