Trend Micro TeamTNT

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

TeamTNT has enumerated the host machine’s IP address.

TeamTNT has used UPX and Ezuri packer to pack its binaries.

TeamTNT has encrypted its binaries via AES and encoded files using Base64.

TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

TeamTNT has used shell scripts for execution.

TeamTNT has cleared command history with history -c.

TeamTNT has used an IRC bot for C2 communications.

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.

TeamTNT has modified the permissions on binaries with chattr.

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

TeamTNT has searched for unsecured SSH keys.

TeamTNT has queried the AWS instance metadata service for credentials.

TeamTNT has scanned specific lists of target IP addresses.

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect. TeamTNT has also searched for Kubernetes pods running in a local network.