TeamTNT

TeamTNT is a Linux-focused cybercrime threat cluster best known for cloud and container intrusions that monetize access through unauthorized Monero mining and broad credential theft. The group has repeatedly targeted exposed or weakly secured cloud-native infrastructure, including Docker environments and misconfigured container services, and has also exploited weak operational security such as exposed private keys, reused passwords, and cloud misconfigurations to gain access.

Its tooling and tradecraft center on Linux and containerized environments. TeamTNT has used malicious containers and abused exposed Docker REST APIs to deploy payloads, launch privileged containers, mount host filesystems, and pivot from containers to underlying hosts. Operations have included internet-scale scanning for additional exposed Docker services and enumeration of Kubernetes-related services, enabling worm-like propagation across cloud estates and adjacent systems.

A defining characteristic of TeamTNT activity is aggressive credential harvesting after compromise. The malware has searched compromised systems and connected environments for cloud and non-cloud service configuration files, application data, and stored credentials, including SSH and SMB credentials. It has also targeted Docker registry credentials and used harvested access to move laterally, automate logins, and potentially enable follow-on abuse such as cloud resource hijacking or supply-chain compromise. Collected data is exfiltrated to attacker-controlled infrastructure.

TeamTNT commonly relies on native Linux utilities and lightweight shell-based tooling for execution, discovery, persistence, and evasion. Observed behaviors include use of common command-line tools to download and execute payloads, inspect users and processes, alter cron-based persistence, clear shell history, and remove competing miners or traces of activity. The group has also used SSH-based propagation and techniques that facilitate container escape and host-level post-exploitation.

Although TeamTNT is frequently associated with cryptojacking, its operations extend beyond simple miner deployment. Campaigns have incorporated host reconnaissance, credential access, lateral movement, persistence, exfiltration, and post-compromise abuse of legitimate administration and monitoring technologies in container environments. TeamTNT is widely tracked as a significant Linux and cloud threat actor whose activity illustrates the convergence of cryptomining, credential theft, and cloud-native intrusion tradecraft.