TeamTNT
TeamTNT is a commodity-focused cloud and Linux threat actor widely associated with cryptojacking and credential theft activity. The content describes TeamTNT as a cryptojacking crew and cloud-focused actor that targets exposed cloud and containerized environments, including Docker. Reported objectives and behaviors include deploying cryptocurrency miners, harvesting credentials, and propagating across reachable systems. TeamTNT has uploaded backdoored Docker images to Docker Hub and has used malware that adds cryptocurrency miners as a service. Observed tradecraft in the provided content includes searching /proc/*/environ for environment variables related to AWS, targeting unsecured AWS credentials and Docker API credentials, aggregating collected credentials into text files before exfiltration, and using curl to send credentials over HTTP. TeamTNT has also used curl and wget to download additional software, including batch scripts that download tools and execute cryptocurrency miners, and has used a custom User-Agent HTTP header in shell scripts. Additional behaviors mentioned include enumerating the host machine’s IP address, decoding a Base64-encoded version of WeaveWorks Scope, adding batch scripts to the Startup folder for persistence, and searching for rival malware and removing it if found. TeamTNT has also searched running processes for strings such as aliyun or liyun to identify Alibaba Cloud security tools. The content further states that TeamTNT disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud infrastructure. In cloud-focused campaigns and research references, TeamTNT is specifically associated with credential-harvesting scripts, and one TeamTNT shell script referenced azure.json in a credential file targeting list. A TeamTNT shell script also contained hardcoded credentials used to connect to a command-and-control server and upload harvested data. A TeamTNT container examined in the 2023 SilentBob campaign had commands that installed or downloaded tools used for propagation and reconnaissance, including zgrab, tor, curl, wget, libproxychains3, and masscan. The content notes that some campaigns share similarities with tools attributed to TeamTNT, but attribution can be challenging because script-based tooling is easily reused or adapted. Known alias in the provided content: teamtnt.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
55 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.
3 more CVEs tied to this actor tracked in Mallory.
Observables
125 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a commodity-focused cryptomining threat actor used as a comparison point for wallet reuse behavior.
Listed in the detection annotations as a threat actor associated with this analytic context.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Named threat actor referenced in Linux cloud threat reporting.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.