ATT&CK ReferencesCado Security TeamTNT Worm August 2020

Cado Security TeamTNT Worm August 2020

Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1046 Network Service Discovery	GroupTeamTNT	TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments. Cado Security TeamTNT Worm August 2020 Cisco Talos Intelligence Group Palo Alto Black-T October 2020 Unit 42 Hildegard Malware
T1071.001 Web Protocols	GroupTeamTNT	TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts. Cado Security TeamTNT Worm August 2020 Cisco Talos Intelligence Group Intezer TeamTNT September 2020 Trend Micro TeamTNT
T1496.001 Compute Hijacking	GroupTeamTNT	TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency. Cado Security TeamTNT Worm August 2020 Cisco Talos Intelligence Group Lacework TeamTNT May 2021
T1552.001 Credentials In Files	GroupTeamTNT	TeamTNT has searched for unsecured AWS credentials and Docker API credentials. Cado Security TeamTNT Worm August 2020 Cisco Talos Intelligence Group Trend Micro TeamTNT
T1552.004 Private Keys	GroupTeamTNT	TeamTNT has searched for unsecured SSH keys. Cado Security TeamTNT Worm August 2020 Trend Micro TeamTNT

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.