Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
12 malware familiesExploits CVEs in the wild

TeamTNT

Also known asTeamTNT

TeamTNT is a commodity-focused cloud and Linux threat actor widely associated with cryptojacking and credential theft activity. The content describes TeamTNT as a cryptojacking crew and cloud-focused actor that targets exposed cloud and containerized environments, including Docker. Reported objectives and behaviors include deploying cryptocurrency miners, harvesting credentials, and propagating across reachable systems. TeamTNT has uploaded backdoored Docker images to Docker Hub and has used malware that adds cryptocurrency miners as a service. Observed tradecraft in the provided content includes searching /proc/*/environ for environment variables related to AWS, targeting unsecured AWS credentials and Docker API credentials, aggregating collected credentials into text files before exfiltration, and using curl to send credentials over HTTP. TeamTNT has also used curl and wget to download additional software, including batch scripts that download tools and execute cryptocurrency miners, and has used a custom User-Agent HTTP header in shell scripts. Additional behaviors mentioned include enumerating the host machine’s IP address, decoding a Base64-encoded version of WeaveWorks Scope, adding batch scripts to the Startup folder for persistence, and searching for rival malware and removing it if found. TeamTNT has also searched running processes for strings such as aliyun or liyun to identify Alibaba Cloud security tools. The content further states that TeamTNT disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud infrastructure. In cloud-focused campaigns and research references, TeamTNT is specifically associated with credential-harvesting scripts, and one TeamTNT shell script referenced azure.json in a credential file targeting list. A TeamTNT shell script also contained hardcoded credentials used to connect to a command-and-control server and upload harvested data. A TeamTNT container examined in the 2023 SilentBob campaign had commands that installed or downloaded tools used for propagation and reconnaissance, including zgrab, tor, curl, wget, libproxychains3, and masscan. The content notes that some campaigns share similarities with tools attributed to TeamTNT, but attribution can be challenging because script-based tooling is easily reused or adapted. Known alias in the provided content: teamtnt.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

15 of 15 tactics76 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1595
Active Scanning
T1595.002
Vulnerability Scanning
TA0042
Resource Development
2 techniques
T1587
Develop Capabilities
T1587.001
Malware
T1608
Stage Capabilities
T1608.001
Upload Malware
T1608.002
Upload Tool
TA0001
Initial Access
2 techniques
T1190×3
Exploit Public-Facing Application
T1195
Supply Chain Compromise
TA0002
Execution
5 techniques
T1053
Scheduled Task/Job
T1059
Command and Scripting Interpreter
T1059.001×8
PowerShell
T1059.003×3
Windows Command Shell
T1129
Shared Modules
T1569
System Services
T1569.002
Service Execution
T1574
Hijack Execution Flow
TA0003
Persistence
5 techniques
T1037
Boot or Logon Initialization Scripts
T1037.001
Logon Script (Windows)
T1053
Scheduled Task/Job
T1098
Account Manipulation
T1098.004
SSH Authorized Keys
T1543
Create or Modify System Process
T1543.003×3
Windows Service
T1547
Boot or Logon Autostart Execution
T1547.001×3
Registry Run Keys / Startup Folder
TA0004
Privilege Escalation
5 techniques
T1037
Boot or Logon Initialization Scripts
T1037.001
Logon Script (Windows)
T1053
Scheduled Task/Job
T1098
Account Manipulation
T1098.004
SSH Authorized Keys
T1543
Create or Modify System Process
T1543.003×3
Windows Service
T1547
Boot or Logon Autostart Execution
T1547.001×3
Registry Run Keys / Startup Folder
TA0005
Stealth
8 techniques
T1027×3
Obfuscated Files or Information
T1027.013
Encrypted/Encoded File
T1036
Masquerading
T1070×2
Indicator Removal
T1070.004×4
File Deletion
T1140×4
Deobfuscate/Decode Files or Information
T1218
System Binary Proxy Execution
T1497
Virtualization/Sandbox Evasion
T1497.001
System Checks
T1564
Hide Artifacts
T1564.006
Run Virtual Instance
T1574
Hijack Execution Flow
TA0112
Defense Impairment
1 technique
T1578
Modify Cloud Compute Infrastructure
TA0006
Credential Access
2 techniques
T1552×2
Unsecured Credentials
T1552.001
Credentials In Files
T1555
Credentials from Password Stores
TA0007
Discovery
11 techniques
T1012
Query Registry
T1016×3
System Network Configuration Discovery
T1046×4
Network Service Discovery
T1057×2
Process Discovery
T1082×3
System Information Discovery
T1083
File and Directory Discovery
T1120
Peripheral Device Discovery
T1497
Virtualization/Sandbox Evasion
T1497.001
System Checks
T1518
Software Discovery
T1526
Cloud Service Discovery
T1613
Container and Resource Discovery
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.004×2
SSH
TA0009
Collection
1 technique
T1074
Data Staged
TA0011
Command and Control
4 techniques
T1071×2
Application Layer Protocol
T1071.001×3
Web Protocols
T1090
Proxy
T1090.003
Multi-hop Proxy
T1105×6
Ingress Tool Transfer
T1219×2
Remote Access Tools
TA0010
Exfiltration
2 techniques
T1041
Exfiltration Over C2 Channel
T1567
Exfiltration Over Web Service
TA0040
Impact
1 technique
T1565
Data Manipulation
T1565.001
Stored Data Manipulation
WEAPONIZED

Associated vulnerabilities

8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

CVE-2021-31207Post-auth Arbitrary File Write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34473ProxyShell pre-auth SSRF in Microsoft Exchange AutodiscoverIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34523Microsoft Exchange PowerShell Backend Elevation of Privilege (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2022-26134Atlassian Confluence Server and Data Center OGNL Injection RCEIn the wildEvidence1

The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.

3 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

125 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping55

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal12

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs8

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables125

Domains, IPs, and hashes tied to this actor, refreshed continuously.