Skip to content

TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.

ATT&CK ID: G0139
Techniques: 43
Tools: 4

Techniques

Reconnaissance

Active Scanning

Resource Development

Acquire Infrastructure Develop Capabilities Stage Capabilities

Initial Access

External Remote Services

Execution

Command and Scripting Interpreter User Execution System Services Container Administration Command Deploy Container

Persistence

Account Manipulation External Remote Services Create Account Create or Modify System Process Boot or Logon Autostart Execution

Privilege Escalation

Account Manipulation Create or Modify System Process Boot or Logon Autostart Execution Escape to Host

Stealth

Rootkit Obfuscated Files or Information Masquerading Indicator Removal Deobfuscate/Decode Files or Information

Defense Impairment

File and Directory Permissions Modification Disable or Modify Tools Disable or Modify System Firewall

Credential Access

Unsecured Credentials

Discovery

System Service Discovery System Network Configuration Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Peripheral Device Discovery Software Discovery Container and Resource Discovery Local Storage Discovery

Lateral Movement

Remote Services

Collection

Command and Control

Application Layer Protocol Web Service Ingress Tool Transfer Remote Access Tools

Exfiltration

Exfiltration Over Alternative Protocol

Impact

Resource Hijacking

Software

Hildegard · LaZagne · MimiPenguin · Peirates

MITRE ATT&CK All threat actors