TeamTNTThreat actor
- adept libra
In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow dashboards, and Weave Scope, exploiting these environments in order to steal cloud credentials, open backdoors, mine cryptocurrency, and launch a worm that is…From MISP Galaxy
Last reported 2 months ago, by Infosecurity Magazine3 reports
ATT&CK techniques
6 of 43 · each with the sentence it comes from- T1014Rootkit
“The script installs the Diamorphine rootkit for stealth and root privileges, and uses custom tools to maintain persistence and control.”
- T1036Masquerading
“A custom flag enabled process masquerading, spoofing legitimate names such as ssh in process listings, which Group-IB mapped to MITRE technique T1564.013.”
- T1110Brute Force
“TeamTNT’s ongoing campaigns target VPS cloud infrastructures on CentOS, beginning with SSH brute force attacks and malicious script uploads.”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1021.004SSH
“T1021.004 Remote Services: SSH”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Cryptominer Abuses Linux PAM to Hide From SOC Analysts“Read more on cryptojacking crews: Cryptojacking Gang TeamTNT Make a Comeback”
-
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer“Commodity-focused threat actors such as Kinsing and TeamTNT reuse wallets across dozens of samples.”
-
Storm clouds on the horizon: Resurgence of TeamTNT?“Storm clouds on the horizon: Resurgence of TeamTNT?”
Indicators in its reports
named in the reports above- 83.142.209[.]214in 1 report
- 94.156.64[.]241in 1 report
- 46096a72d84db5f1dafd944fcf6571c8in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.