TeamTNT

Also known as Adept Libra

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow dashboards, and Weave Scope, exploiting these environments in order to steal cloud credentials, open backdoors, mine cryptocurrency, and launch a worm that is looking for the next victim. They're linked to the First Crypto-Mining Worm to Steal AWS Credentials and Hildegard Cryptojacking malware. TeamTNT is a relatively recent addition to a growing number of threats targeting the cloud. While they employ some of the same tactics as similar groups, TeamTNT stands out with their social media presence and penchant for self-promotion. Tweets from the TeamTNT’s account are in both English and German although it is unknown if they are located in Germany.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1007 System Service Discovery T1014 Rootkit T1016 System Network Configuration Discovery T1021.004 SSH T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1046 Network Service Discovery T1048 Exfiltration Over Alternative Protocol T1049 System Network Connections Discovery T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.009 Cloud API T1059.013 Container CLI/API T1070.003 Clear Command History T1070.004 File Deletion T1071 Application Layer Protocol T1071.001 Web Protocols T1074.001 Local Data Staging T1082 System Information Discovery T1083 File and Directory Discovery T1098.004 SSH Authorized Keys T1102 Web Service T1105 Ingress Tool Transfer T1120 Peripheral Device Discovery T1133 External Remote Services T1136.001 Local Account T1140 Deobfuscate/Decode Files or Information T1204.003 Malicious Image T1219 Remote Access Tools T1222.002 Linux and Mac Permissions T1496.001 Compute Hijacking T1518.001 Security Software Discovery T1543.002 Systemd Service T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1552.001 Credentials In Files T1552.004 Private Keys T1552.005 Cloud Instance Metadata API T1569.003 Systemctl T1583.001 Domains T1587.001 Malware T1595.001 Scanning IP Blocks T1595.002 Vulnerability Scanning T1608.001 Upload Malware T1609 Container Administration Command T1610 Deploy Container T1611 Escape to Host T1613 Container and Resource Discovery T1680 Local Storage Discovery T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.