TeamTNT Reemerged with New Aggressive Cloud Campaign

MITRE Techniques

• [T1133] External Remote Services – Misconfigured Docker API allows access and code execution to everyone. “The Docker API misconfiguration that allows access and code execution to everyone.”
• [T1190] Exploit Public-Facing Application – Targeting exposed Docker/Jupyter/Firebase-like surfaces via public API endpoints. “The infrastructure… targeting exposed Docker APIs and JupyterLab instances.”
• [T1046] Network Service Scanning – Botnet uses Masscan to rapidly scan large address spaces. “Using Masscan, a tool renowned for its high-speed scanning capabilities, we estimate that a /8 CIDR range can be scanned within three minutes.”
• [T1059.004] Unix Shell – Execution of commands via a bash-based downloader on infected hosts. “the execution command is a bash implementation used to download scripts and binaries from the C2 server.”
• [T1105] Ingress Tool Transfer – Downloading tools/scripts from the C2 server. “downloads aws.sh script from the C2 server.”
• [T1098] SSH Authorized Keys – SSH backdoor created by inserting RSA keys and altering SSH config for persistence. “creating an SSH backdoor by inserting their own RSA key.”
• [T1547.001] Boot or Logon Autostart Execution – Persistence through container restart behavior (e.g., –restart=always). “they ran the container with the –restart=always flag.”
• [T1053.005] Cron – Cron-based persistence and removal of Cron to hide activity. “Remove cron, cleans bad tools.”
• [T1564.001] Rootkit – Prochider rootkit hides mining tasks; uses ld.preload to mask xmrig. “deploys prochider rootkit hidden in ldpreload.”
• [T1027] Obfuscated/Compressed Files and Information – Decoding base64-encoded commands to evade detection. “decoding (base64) and running an encoded command.”
• [T1552.001] Credentials in Cloud – Scanning for AWS/Azure/GCP configuration files and secrets. “get_azure(), get_google(), get_aws”
• [T1505.003] Web Shell – Web-based backdoors (e.g., tmate, Gsocket PHP) to maintain access. “webshell of tmate.io” and “Gsocket… a powerful reverse shell tool.”
• [T1071.001] IRC – Command and Control over IRC channels (C2 via IRC). “IRC channel to observe infected machines and commands.”
• [T1589.003] Cloud Service Discovery – Discovery of Kubernetes, Docker, and cloud configurations during discovery phases. “Discovery… Kubernetes, running containers, and cloud environments.”