Threat Alert: New Malware in the Cloud By TeamTNT

MITRE Techniques

• [T1046] Network Service Scanning – Used to identify misconfigured Docker Daemon targets during the Kangaroo attack. Quote: “…scanning for a misconfigured Docker Daemon…”
• [T1059.004] Unix Shell – Execution of shell scripts (k.sh, s.sh, c.sh, d.sh, b.sh) to install, download, and run payloads. Quote: “The file k.sh that was dropped and executed on the attacked server”
• [T1105] Ingress Tool Transfer – Downloading and executing tools/scripts from C2 (k.sh, en.sh, etc.). Quote: “downloading and running further shell scripts”
• [T1053.003] Cron – Use of cron-related scripts (cronb.sh, clean_cron, lock_cron) to gain persistence and manage tasks. Quote: “Deletes all cron scheduled jobs.”
• [T1021.004] SSH – Lateral movement via SSH keys (Inserts SSH key to the host). Quote: “Inserts TeamTNT’s SSH key to the host.”
• [T1014] Rootkit – Deployment of Diamorphine and Prochider rootkits to hide activity. Quote: “Diamorphine rootkit is deployed” and “Deploys prochider rootkit that hides itself.”
• [T1562.001] Impair Defenses – Deleting logs and stopping/deleting security tools (SELinux, watchdog, GCP aegis, etc.). Quote: “Deletes history and stops and deletes security tools such as SElinux, watchdog, gcloud of GCP, and aegis of Alibaba cloud.”
• [T1496] Resource Hijacking – Monero cryptomining and configuration deployment. Quote: “Downloading a Monero cryptominer and its configuration file and executing a cryptojacking attack.”