Skip to content

G0139 TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.895234176

Item Value
ID G0139
Associated Names
Version 1.1
Created 01 October 2021
Last Modified 14 April 2022
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1098 Account Manipulation -
enterprise T1098.004 SSH Authorized Keys TeamTNT has added RSA keys in authorized_keys.7
enterprise T1583 Acquire Infrastructure -
enterprise T1583.001 Domains TeamTNT has obtained domains to host their payloads.8
enterprise T1595 Active Scanning -
enterprise T1595.001 Scanning IP Blocks TeamTNT has scanned specific lists of target IP addresses.4
enterprise T1595.002 Vulnerability Scanning TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.4
enterprise T1071 Application Layer Protocol TeamTNT has used an IRC bot for C2 communications.4
enterprise T1071.001 Web Protocols TeamTNT has the curl command to send credentials over HTTP and download new software.52 TeamTNT has also used a custom user agent HTTP header in shell scripts.4
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder TeamTNT has added batch scripts to the startup folder.1
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.001 PowerShell TeamTNT has executed PowerShell commands in batch scripts.1
enterprise T1059.003 Windows Command Shell TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.1
enterprise T1059.004 Unix Shell TeamTNT has used shell scripts for execution.4
enterprise T1609 Container Administration Command TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.3
enterprise T1613 Container and Resource Discovery TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.4
enterprise T1136 Create Account -
enterprise T1136.001 Local Account TeamTNT has created local privileged users on victim machines.5
enterprise T1543 Create or Modify System Process -
enterprise T1543.002 Systemd Service TeamTNT has established persistence through the creation of a cryptocurrency mining system service.4
enterprise T1543.003 Windows Service TeamTNT uses malware that adds cryptocurrency miners as a service.1
enterprise T1610 Deploy Container TeamTNT has deployed different types of containers into victim environments to facilitate execution.54
enterprise T1587 Develop Capabilities -
enterprise T1587.001 Malware TeamTNT has developed custom malware such as Hildegard.3
enterprise T1611 Escape to Host TeamTNT has deployed privileged containers that mount the filesystem of victim machine.57
enterprise T1133 External Remote Services TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.5 TeamTNT has also targeted exposed kubelets for Kubernetes environments.3
enterprise T1222 File and Directory Permissions Modification -
enterprise T1222.002 Linux and Mac File and Directory Permissions Modification TeamTNT has modified the permissions on binaries with chattr.4
enterprise T1562 Impair Defenses -
enterprise T1562.001 Disable or Modify Tools TeamTNT has disabled and uninstalled security tools.1
enterprise T1562.004 Disable or Modify System Firewall TeamTNT has disabled iptables.7
enterprise T1070 Indicator Removal on Host -
enterprise T1070.002 Clear Linux or Mac System Logs TeamTNT has removed system logs from /var/log/syslog.7
enterprise T1070.003 Clear Command History TeamTNT has cleared command history with history -c.4
enterprise T1070.004 File Deletion TeamTNT uses a payload that removes itself after running.1
enterprise T1105 Ingress Tool Transfer TeamTNT has the curl command and batch scripts to download new tools.5
enterprise T1046 Network Service Discovery TeamTNT has used masscan to search for open Docker API ports.23 TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.8
enterprise T1027 Obfuscated Files or Information TeamTNT has encrypted its binaries via AES.4 TeamTNT has also encoded files using Base64.7
enterprise T1027.002 Software Packing TeamTNT has used UPX and Ezuri packer to pack its binaries.4
enterprise T1057 Process Discovery TeamTNT searches for rival malware and removes them if found.4
enterprise T1219 Remote Access Software TeamTNT has established tmate sessions for C2 communications.3
enterprise T1021 Remote Services -
enterprise T1021.004 SSH TeamTNT has used SSH to connect back to victim machines.5
enterprise T1496 Resource Hijacking TeamTNT has deployed XMRig Docker images to mine cryptocurrency.92
enterprise T1014 Rootkit TeamTNT has used the open-source rootkit Diamorphine to hide cryptocurrency mining activities on the machine.4
enterprise T1518 Software Discovery -
enterprise T1518.001 Security Software Discovery TeamTNT has searched for security products on infected machines.1
enterprise T1608 Stage Capabilities -
enterprise T1608.001 Upload Malware TeamTNT has uploaded backdoored Docker images to Docker Hub.9
enterprise T1082 System Information Discovery TeamTNT has searched for system version and architecture information.1
enterprise T1016 System Network Configuration Discovery TeamTNT looks for the host machine’s IP address.4
enterprise T1049 System Network Connections Discovery TeamTNT runs netstat -anp to search for rival malware connections.4 TeamTNT has also used libprocesshider to modify /etc/
enterprise T1552 Unsecured Credentials -
enterprise T1552.001 Credentials In Files TeamTNT has searched for unsecured AWS credentials and Docker API credentials.24
enterprise T1552.004 Private Keys TeamTNT has searched for unsecured SSH keys.24
enterprise T1552.005 Cloud Instance Metadata API TeamTNT has queried the AWS instance metadata service for credentials.4
enterprise T1204 User Execution -
enterprise T1204.003 Malicious Image TeamTNT relies on users to download and execute malicious Docker images.9
enterprise T1102 Web Service TeamTNT has leveraged to send collected data back to C2.7


ID Name References Techniques
S0601 Hildegard 3 Application Layer Protocol Unix Shell:Command and Scripting Interpreter Container Administration Command Container and Resource Discovery Local Account:Create Account Systemd Service:Create or Modify System Process Deobfuscate/Decode Files or Information Escape to Host Exploitation for Privilege Escalation External Remote Services Dynamic Linker Hijacking:Hijack Execution Flow Disable or Modify Tools:Impair Defenses Clear Command History:Indicator Removal on Host File Deletion:Indicator Removal on Host Ingress Tool Transfer Masquerade Task or Service:Masquerading Network Service Discovery Software Packing:Obfuscated Files or Information Obfuscated Files or Information Remote Access Software Resource Hijacking Rootkit System Information Discovery Cloud Instance Metadata API:Unsecured Credentials Private Keys:Unsecured Credentials Credentials In Files:Unsecured Credentials Web Service
S0349 LaZagne - Keychain:Credentials from Password Stores Credentials from Web Browsers:Credentials from Password Stores Windows Credential Manager:Credentials from Password Stores Credentials from Password Stores Cached Domain Credentials:OS Credential Dumping LSASS Memory:OS Credential Dumping Proc Filesystem:OS Credential Dumping LSA Secrets:OS Credential Dumping /etc/passwd and /etc/shadow:OS Credential Dumping Credentials In Files:Unsecured Credentials
S0179 MimiPenguin - Proc Filesystem:OS Credential Dumping
S0683 Peirates - Cloud Storage Object Discovery Container Administration Command Container and Resource Discovery Data from Cloud Storage Object Deploy Container Escape to Host Network Service Discovery Steal Application Access Token Container API:Unsecured Credentials Cloud Instance Metadata API:Unsecured Credentials Application Access Token:Use Alternate Authentication Material Cloud Accounts:Valid Accounts


Back to top