TeamTNT

Also tracked as Adept Libra

TeamTNT is a financially motivated group that has targeted cloud and container environments since 2019. It harvests AWS credentials from compromised Linux hosts and containers. It then deploys cryptocurrency miners at scale across the victim environment.

Cloud tradecraft

• Queries the AWS instance metadata service for credentials
• Searches the filesystem for unsecured AWS keys and SSH keys
• Uses AWS CLI with stolen credentials to enumerate the environment
• Deploys XMRig miners on hosts, containers, and Kubernetes clusters
• Adds attacker SSH keys to maintain access on compromised hosts

MITRE ATT&CK techniques

References

• MITRE ATT&CK: TeamTNT (G0139)
• TeamTNT: The First Crypto-Mining Worm to Steal AWS Credentials
• TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations