Home/ Threat Actors/ TeamTNT

🌐TeamTNT

🌐 TeamTNT is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: Unknown. We map 14 detection use cases to this actor across 56 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G0139) ↗

14Use cases

0Articles

56Techniques

0IOCs

About this actor (MITRE)

[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September

Known aliases

TeamTNT

Top techniques

T1007 · System Service Discovery T1014 · Rootkit T1016 · System Network Configuration Discovery

All other tracked techniques

T1021.004 · SSH T1027.002 · Software Packing T1027.013 · Encrypted/Encoded File T1036 · Masquerading T1036.005 · Match Legitimate Resource Name or Location T1046 · Network Service Discovery T1048 · Exfiltration Over Alternative Protocol T1049 · System Network Connections Discovery T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1059.004 · Unix Shell T1059.009 · Cloud API T1059.013 · Container CLI/API T1070.003 · Clear Command History T1070.004 · File Deletion T1071 · Application Layer Protocol T1071.001 · Web Protocols T1074.001 · Local Data Staging T1082 · System Information Discovery T1083 · File and Directory Discovery T1098.004 · SSH Authorized Keys T1102 · Web Service T1105 · Ingress Tool Transfer T1120 · Peripheral Device Discovery T1133 · External Remote Services T1136.001 · Local Account T1140 · Deobfuscate/Decode Files or Information T1204.003 · Malicious Image T1219 · Remote Access Tools T1222.002 · Linux and Mac Permissions T1496.001 · Compute Hijacking T1518.001 · Security Software Discovery T1543.002 · Systemd Service T1543.003 · Windows Service T1547.001 · Registry Run Keys / Startup Folder T1552.001 · Credentials In Files T1552.004 · Private Keys T1552.005 · Cloud Instance Metadata API T1569.003 · Systemctl T1583.001 · Domains T1587.001 · Malware T1595.001 · Scanning IP Blocks T1595.002 · Vulnerability Scanning T1608.001 · Upload Malware T1609 · Container Administration Command T1610 · Deploy Container T1611 · Escape to Host T1613 · Container and Resource Discovery T1680 · Local Storage Discovery T1685 · Disable or Modify Tools T1685.006 · Clear Linux or Mac System Logs T1686 · Disable or Modify System Firewall

Detection use cases (14)

TeamTNT cloud-credential & IMDS scrape from Linux shell (Chimaera / Black-T pattern) AI · profile SΣ TeamTNT container escape / Docker-API abuse spawning XMRig (Hildegard / Kinsing-style miner deploy) AI · profile S Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain MITRE match Linux LPE chain — anomalous algif_aead/esp4/esp6/rxrpc kernel-module load followed by same-user root transition MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match