TeamTNT — ATT&CK profile

Overview

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.

TTPs — 56 techniques across 14 tactics

Reconnaissance

T1595.001 Scanning IP Blocks
T1595.002 Vulnerability Scanning

Resource Development

T1583.001 Domains
T1587.001 Malware
T1608.001 Upload Malware

Credential Access

Discovery

T1007 System Service Discovery
T1016 System Network Configuration Discovery
T1046 Network Service Discovery
T1049 System Network Connections Discovery
T1057 Process Discovery
T1082 System Information Discovery
T1083 File and Directory Discovery
T1120 Peripheral Device Discovery
T1518.001 Security Software Discovery
T1613 Container and Resource Discovery
T1680 Local Storage Discovery

Lateral Movement

T1021.004 SSH

Collection

T1074.001 Local Data Staging

Command and Control

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Impact

T1496.001 Compute Hijacking

Tools & malware (4)

Peirates · MimiPenguin · LaZagne · Hildegard

Reporting (3)

TeamTNT with new campaign aka Chimaera — AT&T Alien Labs
TeamTNT Cryptomining Explosion — Intezer
Taking TeamTNT's Docker Images Offline — Stroud, J