TeamTNT

Overview

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.

Naming & attribution

TeamTNT is tracked under 1 names across the industry. It uses 56 documented ATT&CK techniques — more than 86% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1059.013 Container CLI/API — used by 1 of 174 groups
• T1204.003 Malicious Image — used by 1 of 174 groups
• T1552.005 Cloud Instance Metadata API — used by 1 of 174 groups
• T1569.003 Systemctl — used by 1 of 174 groups
• T1609 Container Administration Command — used by 1 of 174 groups
• T1610 Deploy Container — used by 1 of 174 groups
• T1611 Escape to Host — used by 1 of 174 groups
• T1613 Container and Resource Discovery — used by 1 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Rocke China — 23 shared techniques (33% overlap)
• OilRig Iran — 24 shared techniques (22% overlap)
• Tropic Trooper China — 17 shared techniques (22% overlap)
• FIN13 — 19 shared techniques (21% overlap)
• APT41 China — 22 shared techniques (19% overlap)
• menuPass China — 16 shared techniques (19% overlap)

TTPs — 56 techniques across 14 tactics

Tools & malware (4)

Peirates · MimiPenguin · LaZagne · Hildegard

Reporting (3)

• TeamTNT with new campaign aka Chimaera — AT&T Alien Labs
• TeamTNT Cryptomining Explosion — Intezer
• Taking TeamTNT's Docker Images Offline — Stroud, J