TeamTNT

Techniques (MITRE ATT&CK)56

SourceMITRE ATT&CK

Also known as:Adept Libra

About the group

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity63

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 56

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Scanning IP Blocks Vulnerability Scanning

Resource development

Domains Malware Upload Malware

Execution

PowerShell Windows Command Shell Unix Shell Cloud API Container CLI/API Malicious Image Systemctl Container Administration Command Deploy Container

Persistence

SSH Authorized Keys External Remote Services Local Account Systemd Service Windows Service Registry Run Keys / Startup Folder

Privilege escalation

Escape to Host

Credential access

Credentials In Files Private Keys Cloud Instance Metadata API

Discovery

System Service Discovery System Network Configuration Discovery Network Service Discovery System Network Connections Discovery Process Discovery System Information Discovery File and Directory Discovery Peripheral Device Discovery Security Software Discovery Container and Resource Discovery Local Storage Discovery

Lateral movement

SSH

Collection

Local Data Staging

Command and control

Application Layer Protocol Web Protocols Web Service Ingress Tool Transfer Remote Access Tools

Exfiltration

Exfiltration Over Alternative Protocol

Impact

Compute Hijacking

defense-impairment

Linux and Mac Permissions Disable or Modify Tools Clear Linux or Mac System Logs Disable or Modify System Firewall

stealth

Rootkit Software Packing Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location Clear Command History File Deletion Deobfuscate/Decode Files or Information

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

TeamTNT uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →