TeamTNT Launches Docker Gatling Gun Campaign

MITRE Techniques

• [T1190] Exploit Public-Facing Application – Initial access by exploiting exposed Docker daemons on ports 2375, 2376, 4243, and 4244. [‘Initial access by exploiting exposed Docker daemons on ports 2375, 2376, 4243, and 4244.’]
• [T1059] Command and Scripting Interpreter – Execution of the initial script TDGGinit.sh on compromised systems. [‘Execution of the initial script TDGGinit.sh on compromised systems.’]
• [T1572] Modify Cloud Compute Infrastructure – Create Cloud Instance – Downloading Docker and Dockerswarm binaries to persist in the environment. [‘Downloading Docker and Dockerswarm binaries to persist in the environment.’]
• [T1203] Ex exploitation for Defense Evasion – Using Sliver malware to evade traditional detection methods. [‘Using Sliver malware to evade traditional detection methods.’]
• [T1036] Masquerading – Using familiar naming conventions like Chimaera to evade detection. [‘Using familiar naming conventions like Chimaera to evade detection.’]
• [T1014] Rootkit – Deployment of prochider rootkit found in TeamTNT’s download server. [‘Deployment of prochider rootkit found in TeamTNT’s download server.’]
• [T1081] Unsecured Credentials: Credentials in Files – Searching for and accessing credentials such as SSH and cloud metadata. [‘Searching for and accessing credentials such as SSH and cloud metadata.’]
• [T1046] Network Service Scanning – Using tools like masscan to scan for exposed Docker daemons. [‘Using tools like masscan to scan for exposed Docker daemons.’]
• [T1018] Remote System Discovery – Local network scanning to find additional systems to compromise. [‘Local network scanning to find additional systems to compromise.’]
• [T1071] Web Service – Dead Drop Resolver – Using Docker Hub and web servers for malware distribution and management. [‘Using Docker Hub and web servers for malware distribution and management.’]
• [T1071] Application Layer Protocol – DNS – Using DNS for C2 communication with Sliver malware. [‘Using DNS for C2 communication with Sliver malware.’]
• [T1090] Proxy – Using WireGuard and other proxy techniques for C2 communications. [‘Using WireGuard and other proxy techniques for C2 communications.’]
• [T1496] Resource Hijacking – Running cryptominers and selling computation power of victims. [‘Running cryptominers and selling computation power of victims.’]