TeamTNT

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.^{[6] [10]}

TeamTNT has disguised their scripts with docker-related file names.^[10]

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.^[10]

TeamTNT has searched for attached VGA devices using lspci.^[10]

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.^[3][10] TeamTNT has also targeted exposed kubelets for Kubernetes environments.^[5]

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.^[6] TeamTNT has also searched for Kubernetes pods running in a local network.^[10]

TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.^[5]

TeamTNT has used an IRC bot for C2 communications.^[6]

TeamTNT has used a script that checks /proc/*/environ for environment variables related to AWS.^[10]

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.^[10]

TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.^[7][10]

TeamTNT has created system services to execute cryptocurrency mining software.^[10]

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.^[10]

TeamTNT has run netstat -anp to search for rival malware connections.^[6] TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.^[7]

TeamTNT has enumerated the host machine’s IP address.^[6]

TeamTNT has leveraged iplogger.org to send collected data back to C2.^[8][10]

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.^[4][5][10] TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.^[1]

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.^[3][10]

TeamTNT has searched for rival malware and removes it if found.^[6] TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.^[10]

TeamTNT has established tmate sessions for C2 communications.^[5][10]

TeamTNT has deployed privileged containers that mount the filesystem of victim machine.^[3][8]

TeamTNT has deployed different types of containers into victim environments to facilitate execution.^[3][6] TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.^[10]