TeamTNT Targeted Cloud Instances and Containerized Environments For Two Years

guest · Sep 3, 2022

By Alessandro Mascellino @a_mascellino - August 26, 2022

The threat actor known as TeamTNT has been targeting cloud instances and containerized environments on systems around the world for at least two years.

The findings come from CloudSEK security researchers, who posted an advisory on Thursday detailing a timeline of TeamTNT attacks from February 2020 until July 2021.
Click to expand...

According to the report, the group’s Github profile contains 25 public repositories, most of which are forks of popular red teaming tools and other repositories possibly utilized by them.
Additionally, the domain spotted by CloudSEK and allegedly associated with TeamTNT was registered on February 10, 2020, the same time period when the team began to target Redis servers actively.

In these initial campaigns, CloudSEK said the aim of TeamTNT was cryptojacking, as the group deployed a number of tools typically used for these attacks, including pnscan, Tsunami and xmrigCC, among others.
Click to expand...

In the second half of 2021, the group’s target list reportedly remained the same, but they expanded their credential-stealing capabilities to additional services and applications, including AWS, Filezilla and GitHub, among others. In July, TeamTNT launched a campaign named ‘Chimaera,’ suggesting the group continued their attacks on Docker, Kubernetes, and Weavescope services.

The security researchers suggested the group most likely originated from Germany because most of the tweets and bash scripts (including comments) are in German, and the account’s location is set to 'Deutschland'.
Click to expand...

CloudSEK: Timeline & TTPs of TeamTNT Cybercrime Group

THREAT

• Threat actor group, TeamTNT, compromised multiple cloud instances and containerized environments.
• Target list includes Docker, Redis server, AWS, and Kubernetes.
TTPs

• Reconnaissance
• Credential Stealing
• Installing backdoors, rootkits stealer, botnets, and miners
• Maintain access and moving laterally
• Cryptojacking
Click to expand...

TOOLS

Network/ Port scanning tools

Malicious Binaries

Packers and Crypters

Credential Stealers

PWN Remote Services

Click to expand...

Log in or Sign up

TeamTNT Targeted Cloud Instances and Containerized Environments For Two Years

guest Guest

Log in or Sign up

TeamTNT Targeted Cloud Instances and Containerized Environments For Two Years

guest Guest

Useful Searches