Cisco Talos Intelligence Group

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

TeamTNT has disguised their scripts with docker-related file names.

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

TeamTNT has used shell scripts for execution.

TeamTNT has cleared command history with history -c.

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.

TeamTNT has aggregated collected credentials in text files before exfiltrating.

TeamTNT has searched for system version, architecture, and hostname information.

TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.

TeamTNT has added RSA keys in authorized_keys.

TeamTNT has leveraged iplogger.org to send collected data back to C2.

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.

TeamTNT has searched for attached VGA devices using lspci.

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

TeamTNT has established tmate sessions for C2 communications.

TeamTNT has modified the permissions on binaries with chattr.

TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.

TeamTNT has searched for security products on infected machines.

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

TeamTNT has queried the AWS instance metadata service for credentials.

TeamTNT has created system services to execute cryptocurrency mining software.

TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect. TeamTNT has also searched for Kubernetes pods running in a local network.

TeamTNT has searched for disk partition and logical volume information.

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.