TF-MAL-elf.pro_ocean

Description

ThreatFox malware family `elf.pro_ocean`. Printable name: Pro-Ocean.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Pro-Ocean (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  elf. pro_ocean (Back to overview) Pro-Ocean Propose Change Actor (s): Rocke Unit 42 describes this as a malware used by Rocke Group that deploys an XMRig miner.

  2026-05-17 22:06 UTC
• Rocke Group's Pro Ocean Crypto-jacking Malware now Comes with Worm Feature
  web:sechub.in

  The malware is known as " Pro Ocean ," first detected in 2019, and now includes "worm" features and the detection-evasion features of rootkits. For cloud apps, Pro-Ocean utilizes well-known vulnerabilities Pro-Ocean attacked Apache ActiveMQ, Oracle WebLogic (CVE-2017-10271), and Redis in their study.

  2026-05-17 22:06 UTC
• Trellix Insights: Pro-Ocean malware
  web:support.trellix.com

  Summary Description of Campaign Pro-Ocean cryptojacking malware is attributed to the Rocke Group threat group and targets cloud applications with unsecure instances or known vulnerabilities. The malicious software has been observed focusing on Apache ActiveMQ, Oracle WebLogic, and Redis servers. Multiple obfuscation layers are used to disguise itself including software packing, deleting the ...

  2026-05-17 22:06 UTC
• Pro-Ocean: Rocke Group's New Cryptojacking Malware - Unit 42
  web:unit42.paloaltonetworks.com

  Pro-Ocean is a revised version of cloud-targeted cryptojacking malware , which now includes new and improved rootkit and worm capabilities.

  2026-05-17 22:06 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-17 22:06 UTC
• Submit a file for malware analysis - Microsoft Security Intelligence
  web:www.microsoft.com

  Submit a file for malware analysis Microsoft security researchers analyze suspicious files to determine if they are threats, unwanted applications, or normal files. Submit files you think are malware or files that you believe have been incorrectly classified as malware . For more information, read the submission guidelines.

  2026-05-17 22:06 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-17 22:06 UTC
• ATM Malware Attacks Result In Loss Of $20 Million In 2025 - PCrisk
  web:www.pcrisk.com

  In 2025 and early 2026, law enforcement and cybersecurity agencies in the United States have sounded repeated alarms over the rise of sophisticated ATM "jackpotting" attacks, incidents in which threat actors use malware and physical access to force automated teller machines to dispense cash illegally. The phenomenon has cost financial institutions tens of millions of dollars and prompted an ...

  2026-05-17 22:06 UTC

Only Available for Registered Users. Sign in to view.