Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TeamTNT · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

TeamTNT

  • Adept Libra

MITRE G0139 ↗

TeamTNT — ATT&CK roseTE

attack rose · 56 techniques across 14 tactics

Analyst brief

misp-galaxy + mitre-attack

In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow dashboards, and Weave Scope, exploiting these environments in order to steal cloud credentials, open backdoors, mine cryptocurrency, and launch a worm that is looking for the next victim. They're linked to the First Crypto-Mining Worm to Steal AWS Credentials and Hildegard Cryptojacking malware.

TeamTNT is a relatively recent addition to a growing number of threats targeting the cloud. While they employ some of the same tactics as similar groups, TeamTNT stands out with their social media presence and penchant for self-promotion. Tweets from the TeamTNT’s account are in both English and German although it is unknown if they are located in Germany.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

56 techniques · 14 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    3 techniques

  3. Execution

    9 techniques

  4. Persistence

    6 techniques

  5. Privilege escalation

    1 technique

  6. Stealth

    8 techniques

  7. Defense impairment

    4 techniques

  8. Credential access

    3 techniques

  9. Discovery

    11 techniques

  10. Lateral movement

    1 technique

  11. Collection

    1 technique

  12. Command and control

    5 techniques

  13. Exfiltration

    1 technique

  14. Impact

    1 technique

select a technique

Arsenal

1 malware · 3 tools
Malware
Malware · 1ATT&CK
HildegardS0601 ↗
Tools
Tools · 3ATT&CK
PeiratesS0683 ↗
MimiPenguinS0179 ↗
LaZagneS0349 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

16 sources
  1. 1.unit42.paloaltonetworks.com/hildegard-malware-teamtnt
  2. 2.malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt
  3. 3.blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment
  4. 4.cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-…
  5. 5.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aw…
  6. 6.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020
  7. 7.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable…
  8. 8.cyware.com/news/hildegard-teamtnts-new-feature-rich-malware-targe…
  9. 9.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers
  10. 10.unit42.paloaltonetworks.com/atoms/adept-libra
  11. +6 more in the JSON record

Track TeamTNT on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.