Procedure examples

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

TeamTNT has enumerated the host machine’s IP address.

TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

TeamTNT has used UPX and Ezuri packer to pack its binaries.

TeamTNT has encrypted its binaries via AES and encoded files using Base64.

TeamTNT has disguised their scripts with docker-related file names.

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.

TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

TeamTNT has executed PowerShell commands in batch scripts.

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.

TeamTNT has used shell scripts for execution.

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.

TeamTNT targeted misconfigured containers and used container CLI tools.

TeamTNT has cleared command history with history -c.

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.

TeamTNT has used an IRC bot for C2 communications.

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.

TeamTNT has aggregated collected credentials in text files before exfiltrating.

TeamTNT has searched for system version, architecture, and hostname information.

TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.

TeamTNT has added RSA keys in authorized_keys.

TeamTNT has leveraged iplogger.org to send collected data back to C2.

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.

TeamTNT has searched for attached VGA devices using lspci.

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.

TeamTNT has created local privileged users on victim machines.

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

TeamTNT has relied on users to download and execute malicious Docker images.

TeamTNT has established tmate sessions for C2 communications.

TeamTNT has modified the permissions on binaries with chattr.

TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.

TeamTNT has searched for security products on infected machines.

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.

TeamTNT has used malware that adds cryptocurrency miners as a service.

TeamTNT has added batch scripts to the startup folder.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

TeamTNT has searched for unsecured SSH keys.

TeamTNT has queried the AWS instance metadata service for credentials.

TeamTNT has created system services to execute cryptocurrency mining software.

TeamTNT has obtained domains to host their payloads.

TeamTNT has developed custom malware such as Hildegard.

TeamTNT has scanned specific lists of target IP addresses.

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

TeamTNT has uploaded backdoored Docker images to Docker Hub.

TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.

TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.