MITRE ATT&CKgroup
G0139 TeamTNT
- Domain
- enterprise
- Version
- 1.4
- Created
- 2021-10-01
Description
TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.
Related
Uses · MITRE ATT&CK (60)
- T1685 Disable or Modify Tools technique
- T1685.006 Clear Linux or Mac System Logs sub-technique
- T1686 Disable or Modify System Firewall technique
- T1680 Local Storage Discovery technique
- T1059.013 Container CLI/API sub-technique
- T1569.003 Systemctl sub-technique
- T1496.001 Compute Hijacking sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.009 Cloud API sub-technique
- S0683 Peirates software (tool)
- S0601 Hildegard software (malware)
- T1613 Container and Resource Discovery technique
- T1204.003 Malicious Image sub-technique
- T1611 Escape to Host technique
- T1609 Container Administration Command technique
- T1610 Deploy Container technique
- T1608.001 Upload Malware sub-technique
- T1595.001 Scanning IP Blocks sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1587.001 Malware sub-technique
- T1583.001 Domains sub-technique
- T1098.004 SSH Authorized Keys sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.004 Unix Shell sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1021.004 SSH sub-technique
- T1552.005 Cloud Instance Metadata API sub-technique
References
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera ATT TeamTNT Chimaera September 2020
- https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/ Cado Security TeamTNT Worm August 2020
- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/ Unit 42 Hildegard Malware
- https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf Trend Micro TeamTNT
- https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/ Intezer TeamTNT September 2020
- https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf Intezer TeamTNT Explosion September 2021
- https://blog.aquasec.com/container-security-tnt-container-attack Aqua TeamTNT August 2020
- https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/ Palo Alto Black-T October 2020
- https://www.lacework.com/blog/taking-teamtnt-docker-images-offline Lacework TeamTNT May 2021