1. Home
  2. Groups
  3. TeamTNT

TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

ID: G0139
Contributors: Will Thomas, Cyjax; Darin Smith, Cisco
Version: 1.3
Created: 01 October 2021
Last Modified: 16 September 2024
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1098 .004 Account Manipulation: SSH Authorized Keys

TeamTNT has added RSA keys in authorized_keys.[8][10]
Enterprise T1583 .001 Acquire Infrastructure: Domains

TeamTNT has obtained domains to host their payloads.[1]
Enterprise T1595 .001 Active Scanning: Scanning IP Blocks

TeamTNT has scanned specific lists of target IP addresses.[6]
.002 Active Scanning: Vulnerability Scanning

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.[6]
Enterprise T1071 Application Layer Protocol

TeamTNT has used an IRC bot for C2 communications.[6]
.001 Web Protocols

TeamTNT has the curl command to send credentials over HTTP and the curl and wget commands to download new software.[3][4][10] TeamTNT has also used a custom user agent HTTP header in shell scripts.[6]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

TeamTNT has added batch scripts to the startup folder.[7]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

TeamTNT has executed PowerShell commands in batch scripts.[7]
.003 Command and Scripting Interpreter: Windows Command Shell

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.[7]
.004 Command and Scripting Interpreter: Unix Shell

TeamTNT has used shell scripts for execution.[6][10]
.009 Command and Scripting Interpreter: Cloud API

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.[11]
Enterprise T1609 Container Administration Command

TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.[5]
Enterprise T1613 Container and Resource Discovery

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.[6] TeamTNT has also searched for Kubernetes pods running in a local network.[10]
Enterprise T1136 .001 Create Account: Local Account

TeamTNT has created local privileged users on victim machines.[3]
Enterprise T1543 .002 Create or Modify System Process: Systemd Service

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.[6][10]
.003 Create or Modify System Process: Windows Service

TeamTNT has used malware that adds cryptocurrency miners as a service.[7]
Enterprise T1074 .001 Data Staged: Local Data Staging

TeamTNT has aggregated collected credentials in text files before exfiltrating.[10]
Enterprise T1140 Deobfuscate/Decode Files or Information

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.[10]
Enterprise T1610 Deploy Container

TeamTNT has deployed different types of containers into victim environments to facilitate execution.[3][6] TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.[10]
Enterprise T1587 .001 Develop Capabilities: Malware

TeamTNT has developed custom malware such as Hildegard.[5]
Enterprise T1611 Escape to Host

TeamTNT has deployed privileged containers that mount the filesystem of victim machine.[3][8]
Enterprise T1048 Exfiltration Over Alternative Protocol

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.[10]
Enterprise T1133 External Remote Services

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.[3][10] TeamTNT has also targeted exposed kubelets for Kubernetes environments.[5]
Enterprise T1083 File and Directory Discovery

TeamTNT has used a script that checks /proc/*/environ for environment variables related to AWS.[10]
Enterprise T1222 .002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification

TeamTNT has modified the permissions on binaries with chattr.[6][10]
Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.[7][10]
.004 Impair Defenses: Disable or Modify System Firewall

TeamTNT has disabled iptables.[8]
Enterprise T1070 .002 Indicator Removal: Clear Linux or Mac System Logs

TeamTNT has removed system logs from /var/log/syslog.[8]
.003 Indicator Removal: Clear Command History

TeamTNT has cleared command history with history -c.[6][10]
.004 Indicator Removal: File Deletion

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.[7][10]
Enterprise T1105 Ingress Tool Transfer

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.[3][10]
Enterprise T1036 Masquerading

TeamTNT has disguised their scripts with docker-related file names.[10]
.005 Match Legitimate Name or Location

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.[10]
Enterprise T1046 Network Service Discovery

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.[4][5][10] TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.[1]
Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

TeamTNT has used UPX and Ezuri packer to pack its binaries.[6]
.013 Obfuscated Files or Information: Encrypted/Encoded File

TeamTNT has encrypted its binaries via AES and encoded files using Base64.[6][8]
Enterprise T1120 Peripheral Device Discovery

TeamTNT has searched for attached VGA devices using lspci.[10]
Enterprise T1057 Process Discovery

TeamTNT has searched for rival malware and removes it if found.[6] TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.[10]
Enterprise T1219 Remote Access Software

TeamTNT has established tmate sessions for C2 communications.[5][10]
Enterprise T1021 .004 Remote Services: SSH

TeamTNT has used SSH to connect back to victim machines.[3] TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.[10]
Enterprise T1496 .001 Resource Hijacking: Compute Hijacking

TeamTNT has deployed XMRig Docker images to mine cryptocurrency.[2][4] TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.[10]
Enterprise T1014 Rootkit

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.[6] [10]
Enterprise T1518 .001 Software Discovery: Security Software Discovery

TeamTNT has searched for security products on infected machines.[7][10]
Enterprise T1608 .001 Stage Capabilities: Upload Malware

TeamTNT has uploaded backdoored Docker images to Docker Hub.[2]
Enterprise T1082 System Information Discovery

TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.[7][10]
Enterprise T1016 System Network Configuration Discovery

TeamTNT has enumerated the host machine’s IP address.[6]
Enterprise T1049 System Network Connections Discovery

TeamTNT has run netstat -anp to search for rival malware connections.[6] TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.[7]
Enterprise T1007 System Service Discovery

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.[10]
Enterprise T1569 System Services

TeamTNT has created system services to execute cryptocurrency mining software.[10]
Enterprise T1552 .001 Unsecured Credentials: Credentials In Files

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.[4][6][10]
.004 Unsecured Credentials: Private Keys

TeamTNT has searched for unsecured SSH keys.[4][6]
.005 Unsecured Credentials: Cloud Instance Metadata API

TeamTNT has queried the AWS instance metadata service for credentials.[6][10]
Enterprise T1204 .003 User Execution: Malicious Image

TeamTNT has relied on users to download and execute malicious Docker images.[2]
Enterprise T1102 Web Service

TeamTNT has leveraged iplogger.org to send collected data back to C2.[8][10]

Software

ID Name References Techniques
S0601 Hildegard [5] Application Layer Protocol, Command and Scripting Interpreter: Unix Shell, Container Administration Command, Container and Resource Discovery, Create Account: Local Account, Create or Modify System Process: Systemd Service, Deobfuscate/Decode Files or Information, Escape to Host, Exploitation for Privilege Escalation, External Remote Services, Hijack Execution Flow: Dynamic Linker Hijacking, Impair Defenses: Disable or Modify Tools, Indicator Removal: File Deletion, Indicator Removal: Clear Command History, Ingress Tool Transfer, Masquerading: Masquerade Task or Service, Network Service Discovery, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information: Encrypted/Encoded File, Remote Access Software, Resource Hijacking: Compute Hijacking, Rootkit, System Information Discovery, Unsecured Credentials: Private Keys, Unsecured Credentials: Credentials In Files, Unsecured Credentials: Cloud Instance Metadata API, Web Service
S0349 LaZagne [7] Credentials from Password Stores: Windows Credential Manager, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores, Credentials from Password Stores: Keychain, OS Credential Dumping: LSA Secrets, OS Credential Dumping: /etc/passwd and /etc/shadow, OS Credential Dumping: LSASS Memory, OS Credential Dumping: Cached Domain Credentials, OS Credential Dumping: Proc Filesystem, Unsecured Credentials: Credentials In Files
S0179 MimiPenguin [1] OS Credential Dumping: Proc Filesystem
S0683 Peirates [12] Cloud Storage Object Discovery, Container Administration Command, Container and Resource Discovery, Data from Cloud Storage, Deploy Container, Escape to Host, Network Service Discovery, Steal Application Access Token, Unsecured Credentials: Container API, Unsecured Credentials: Cloud Instance Metadata API, Use Alternate Authentication Material: Application Access Token, Valid Accounts: Cloud Accounts

References

  1. Quist, N. (2020, October 5). Black-T: New Cryptojacking Variant from TeamTNT. Retrieved September 22, 2021.
  2. Stroud, J. (2021, May 25). Taking TeamTNT's Docker Images Offline. Retrieved September 16, 2024.
  3. Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.
  4. Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021.
  5. Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.
  6. Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.
  1. AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.
  2. Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.
  3. Intezer. (2021, September 1). TeamTNT Cryptomining Explosion. Retrieved October 15, 2021.
  4. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  5. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved July 8, 2022.
  6. Nathaniel Quist. (2021, June 4). TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations. Retrieved February 8, 2022.