🚀 CloudSEK has raised $19M Series B1 Round – Powering the Future of Predictive Cybersecurity
Read More
Home
Threat Intelligence Posts
Adversary Intelligence

Timeline & TTPs of TeamTNT Cybercrime Group

The threat actor group, TeamTNT, compromised multiple cloud instances and containerized environments.The target list includes Docker, Redis server, AWS, and Kubernetes.
Updated on
April 19, 2023
Published on
August 25, 2022
Read MINUTES
5
Subscribe to the latest industry news, threats and resources.
 
Category: Adversary Intelligence Industry: IT & Technology Region: Global Source: A2

Executive Summary

THREAT TTPs TOOLS
  • Threat actor group, TeamTNT, compromised multiple cloud instances and containerized environments.
  • Target list includes Docker, Redis server, AWS, and Kubernetes.
  • Reconnaissance
  • Credential Stealing
  • Installing backdoors, rootkits stealer, botnets, and miners
  • Maintain access and moving laterally
  • Cryptojacking
  • Network/ Port scanning tools
  • Malicious Binaries
  • Packers and Crypters
  • Credential Stealers
  • PWN Remote Services

Analysis and Attribution

History

  • TeamTNT goes by the Twitter handle “@HildeTnT / HildeGard@TeamTNT”
  • During their attack period, the group was very active on Twitter, posting and discussing:
    • Attacks conducted
    • Servers compromised
    • Tools employed
  • The group most likely originates from Germany because:
    • Most of the tweets and bash scripts are in the German language.
    • The account’s location is set to Deutschland.
    • Comments in the bash scripts contain words from the German language.

Information from OSINT

  • The following Tweet made on the group’s official account, suggests that it is a collective of 12 individuals (or more if they hired new people in late 2020).
[caption id="attachment_20458" align="aligncenter" width="1198"]TeamTNT’s Tweet about managing a group of 12 programmers TeamTNT’s Tweet about managing a group of 12 programmers[/caption]  
  • TeamTNT’s Github profile contains 25 public repositories, most of which are the forks of the popular red teaming tools and other repositories possibly leveraged by them.
  • The following domain was used by the group to host their malicious files and scripts while performing the attack: https://teamtnt[.]red.
  • CloudSEK researchers were able to gather the following information about the domain:
    • Domain was registered on 10 February 2020
    • During the same time TeamTNT had begun to actively target Redis servers
    • Domain is currently inactive
    • Some screenshots of the domain are still available on Wayback Machine

Timeline of TeamTNT

[caption id="attachment_20459" align="alignnone" width="2048"]Event Timeline of TeamTNT Event Timeline of TeamTNT[/caption]  

Redis Attacks (February 2020)

  • The group has been active since February 2020 when they launched their first campaign targeting Redis servers.
[caption id="attachment_20460" align="aligncenter" width="2048"]Attack flow for targeting the Redis server Attack flow for targeting the Redis server[/caption]  
  • The motive behind the attack was cryptojacking and the following tools were used:
    • pnscan - An open-source parallel network scanner, used to scan the whole internet and look for the services listening on the default Redis port (port: 6379). The setup script generates the payload that is executed on the Redis servers.
    • Tsunami - An open-source botnet, aslo known as titan or ziggystartux, used to perform DDoS attacks against targets or to execute commands on the infected machine.
    • xmrigCC - A tool used for mining crypto.
    • watchdog.c - A type of monitoring tool used in Linux for monitoring the mining process.
    • Punk.py - A post-exploitation tool meant to help network pivot from a compromised Unix box. This tool collects usernames, SSH keys, as well as known hosts from a Unix systemt and then tries to connect via SSH to all the combinations found.
[caption id="attachment_20461" align="alignnone" width="2048"]Detailed breakdown of the setup script used in Redis campaign Detailed breakdown of the setup script used in Redis campaign[/caption]  

Docker Attacks (May 2020)

  • In May 2020, the group started targeting Docker by employing the same Bash scripts and malware.
  • The group’s primary motive remained the same, i.e cryptojacking.
  • A new tool was added to their arsenal:
    • masscan - A TCP port scanner used to find misconfigured Docker services by scanning exposed ports and services. Once a victim is located, using masscan and zgrab, the attacker creates a container using Alpine image and passes an argument to the script which downloads and executes other malicious scripts.
[caption id="attachment_20462" align="alignnone" width="2048"]Targeting Docker Instances using a Bash script Targeting Docker Instances using a Bash script[/caption]

Improvised Docker Attacks (August 2020)

  • The group continued their attacks on Docker however they started using the Ubuntu images directly instead of Alpine.
  • The group started using a Linux Kernel Module (LKM) rootkit named Diamorphine to hide their activities on infected machines.
  • AWS credential-stealing capabilities were added into their scripts.

Weavescope Attacks (September 2020)

  • TeamTNT added started exploiting Weavescope for troubleshooting and leveraging it as a backdoor for the following:
    • Gaining full access to the victim’s cloud environment
    • Monitoring Docker, Kubernetes, the Distributed Cloud Operating System (DC/OS), and AWS Elastic Compute Cloud (ECS)
    • Running shell commands
  • The group began using two new tools to steal credentials from browser history and network connections:
  • The group also began using a simple Linux ELF runtime crypter, ezuri, to encrypt their malware for evading detection.

Kubernetes Attacks (January 2021)

  • Lacework Labs released a report on Tsunami (the bot used by TeamTNT) mentioning the following details:
    • Only 90 of the 200 connected bots were detected with unique IP addresses from the previous scripts.
    • Some of the bots behind a NAT service were sharing the same external IP address.
    • Majority of the affected computers were Asian cloud instances hosted primarily by Tencent, Alibaba, and AWS.
  • During this period, the group stopped attacking Redis instances and started targeting Kubernetes.
  • Three new tools were being employed by the group:
    • Peirates - An open-source Kubernetes Penetration Testing tool
    • Botb - An open-source tool for container analysis and exploitation for Kubernetes
    • libprocesshider - An open-source tool that uses the ID preloader to hide a process under Linux.

Increased Credential Stealing Capabilities (June 2021)

  • The group’s target list remained the same but they expanded their credential-stealing capabilities, to the following services and applications.
AWS Shodan PostgreSQL
S3 buckets GCP SMB
Docker ngrok Hexchat
SSH MoneroGuiWallet Filezilla
Davfs2 GitHub
  • They added the plugin of AWS CLI in their script to exfiltrate maximum information about the instance inclduing resources, instance, roles, volumes, etc.

Chimaera Campaign (July 2021)

  • On 25 July 2021, TeamTNT launched a campaign named “Chimaera” where they continued their attacks on Docker, Kubernetes, and Weavescope services.
  • To maintain transparency, the group created a dashboard on their website that displayed campaign statistics.
[caption id="attachment_20463" align="alignnone" width="845"]Chimaera campaign dashboard to display statistics on the website Chimaera campaign dashboard to display statistics on the website[/caption]
  • The group significantly improved their enumeration technique by adding over 70 unique AWS CLI commands designed to enumerate the following 7 AWS services:
    • IAM configuration
    • EC2 instances
    • S3 buckets
    • Support cases
    • Direct connection
    • CloudTrail
    • CloudFormation
  • They also started employing LaZagne, another open-source application, to enhance their credential-stealing capabilities.

Techniques, Tactics & Procedures (TTPs)

[caption id="attachment_20464" align="alignnone" width="1677"]TTPs employed by TeamTNT TTPs employed by TeamTNT[/caption]   TeamTNT essentially employed the same strategies across all of its campaigns, however they did it by making the following adjustments to their methods:
  • Account manipulation by adding their own SSH authorized_keys on compromised servers.
  • Installing a scanner to scan the entire internal network for lateral movements.
  • Using process monitoring tools to restart processes.
  • Using scripts to install all sorts of tools, malware, and miner.
  • Packing binaries to evade normal security checks .
  • Using obfuscation and encodings in bash scripts and while communicating through C2 servers.
  • Using kernel-level rootkits to hide their process.
  • Deploying own containers for attacks and mining.
  • Using data stealing cloud service credentials.
  • Resource hijacking and deploying XMRig Docker images to mine cryptocurrency.

Tools & Exploits

TeamTNT employed mostly open-source tools and depended heavily on bash scripts to manage all the tools. The table below contain the list of tools used by them for conducting their activities.
Tools & Exploits

Network & Port Scanning Tools

Packers & Crypters
Pnscan masscan zgrab Ezuri UPX

Malicious Binaries

Credential Stealer
Tsunami (IRC bot malware) xmrigCC Diamorphine Libprocesshide rathole Punk.py LaZagne Mimipy Mimipenguin

CPWN Remote Services (Redis, Docker, Kubernetes)
Mostly they used custom scripts to pwn the services like Redis, Kubernetes Peirates Botb Docker Escape Tool (CVE-2019-5736)

Indicators of Compromise (IoCs)

SHA256
setup.sh b5ba2c86ebf85cbf700c83d7edc034717d7ee08e84fbae440a38139c15ef7a27
watchdogd(32-bit) 69fea980538a12ac0791f0801fc93d8b4d16e8329793d635221a16f935e8ca07
XMRig Miner(32-bit) 4256402fc04e49f3da8d1bf88efdcca6a3b03f4b881777d2c32a8df364cececd
bioset da43ed194729f82db68b1d91a17cea6afde8ae81357116c35c4c129888a836bf
config.json 285e91d3d578fcaf6665c70de457f602d572203b04c281c03b4bf9103aa5f61f
do.sh 9c29d4ecf6a60e7bfc0afbaa7a669a18af163440730711367d1c715042b5f755
watchdogd(64-bit) fdf26ebad48da26be59b5784f43d1e5ee2efa93c59a717fe2ae1d82bf3f016d3
XMRig Miner(62-bit) b6f57f8a7fba70d6660335828d2a14029c88079a8176dca2c63281a759fd84ca
log.c 59aa2101b05225dd0eb7e7b456eb26357540723e3c1d8a10deca83e9715a10fb
full-cleanup 6a1221fc82b2bf13dc8112795d3edfb7bab8df7a9d4af69b89da4ac31e0e87e5
narrenkappe.sh a25a73af06c43a20eb9f4f8b67357cec3c74143ccf97ce666446296a360d93fa
punk.py a66140870d0a71c7bd42b7631e4a85858e6b33e4a21be637b94d41833dee8383
s_poor.ssh.sh 1eead4f456ed8741d1de821e2fcecb026c1cbbf3477786cc3e637eac05811f46
whois2.irc.sh 795a3d99c1e8e34a6228d95c4435c5ed7c866dc0e303f9788ea6fe055b1a7ac6
whois.irc 205db0ef59cad167c6132916f8f7a1d1963e740b36400419b2e5ba307e9f765c
dns3 07377cac8687a4cde6e29bc00314c265c7ad71a6919de91f689b58efe07770b0
init.sh (the second script) 5c488d9d6820f859cde5fb5d147cfe584a603152653d12e720b897df60c6f810
clean.sh 6b8d828511b479e3278264eff68059f03b3b8011f9a6daaeff2af06b13ba6090
mxutzh.sh 8926672fe6ab2f9229a72e344fcb64a880a40db20f9a71ba0d92def9c14497b6
setup.mytoys.sh b60be03a7305946a5b1e2d22aa4f8e3fc93a55e1d7637bebb58bf2de19a6cf4a
setup.xmrig.curl.sh bebaac2a2b1d72aa189c98d00f4988b24c72f72ae9348c49f62d16b433b05332
sysinfo 3c907087ec77fc1678011f753ddf4531a484009f3c64563d96eff0edea0dcd29
portainer b49a3f3cb4c70014e2c35c880d47bc475584b87b7dfcfa6d7341d42a16ebe443
tt.sh 2cde98579162ab165623241719b2ab33ac40f0b5d0a8ba7e7067c7aebc530172
aws.sh 8cedd6187439f73675b076d70647ee117ec3a4184a5045499a6172ae6e6c2c39
grab_aws-data.sh a1e9cd08073e4af3256b31e4b42f3aa69be40862b3988f964e96228f91236593
init.sh 4e059d74e599757226f93ea8ddcfb794d4bcda605f0e553fbbef47b8b7c82d2b
search.sh ed40bce040778e2227c869dac59f54c320944e19f77543954f40019e2f2b0c35
setup_moneroocean_miner.sh 5923f20010cb7c1d59aab36ba41c84cd20c25c6e64aace65dc8243ea827b537b
Domain / IPv4
Exfiltration server 123.56.193[.]119
Miner CC 54.203.159[.]179
C2 80.211.206[.]105 164.68.106[.]96 62.234.121[.]105
Hosting malicious scripts and binaries 85..214.149[.]236 45.9.148[.]108 5.9.148[.]35
domain/email teamtnt[.]red chimaera[.]cc hilde@teamtnt[.]red
Wallets/Keys
Wallets 88ZrgnVZ687Wg8ipWyapjCVRWL8yFMRaBDrxtiPSwAQr Nz5ZJBRozBSJrCYffurn1Qg7Jn7WpRQSAA3C8aidaeadAn4xi4k 84dg9MjSkFvXkqHQuBr6ep6TfhR3pTP8DRyTMN5s8RgYMVRc nce7Day8edLkk3TqAaSHXu2N4W3A3XjKMaSx4X8Q3KQgZnh 46EPFzvnX5GH61ejkPpNcRNm8kVjs8oHS9VwCkKRCrJX27XE W2y1NPLfSa54DGHxqnKfzDUVW1jzBfekk3hrCVCmAUrFd3H
ssh-rsa (key) AAAAB3NzaC1yc2EAAAADAQABAAABAQDIzB9hz7bNT6qtQK CMcitaaxEB9RyJEZuumE+gUMrh6hg3ccSMg9qnAlS/Lmw5Sw wLJQXMB5WuhclPJsVawuP+pfsm1ZiGF2JnczEW5kBw1o5Fl/ 6WOV1p9MOaXHAbpi7o/5Zauu3lTktyIWuP5R9l/2pUWcFZInn aiOr1KNtCBPisNYbZ4FWAQVGwXzUWZ/ZE7SYIoOUm3EJihP PiTulegUmIzc7TzrnEn9M3U8K+LVFye+wDeSC3WNYwfjGQJA 4aFsANOiz89olh77G7IaDR8LghNfVVkRjaJ6onDZwb2CZWSiv kFsdYtL6690S407eqoes7wkJudo9Qxsn9wxNv

References

Appendix

[caption id="attachment_20465" align="alignnone" width="1167"]Example of TeamTNT using German language on social media Example of TeamTNT using German language on social media[/caption]   [caption id="attachment_20466" align="alignnone" width="2048"]GitHub Repositories of the TeamTNT group GitHub Repositories of the TeamTNT group[/caption]   [caption id="attachment_20467" align="alignnone" width="1095"]DNS script used by TeamTNT during the attack campaign of docker instances DNS script used by TeamTNT during the attack campaign of docker instances[/caption]   [caption id="attachment_20468" align="alignnone" width="2048"]Hosted a script to pwn Kubernetes clusters Hosted a script to pwn Kubernetes clusters[/caption]   [caption id="attachment_20469" align="alignnone" width="2048"]Wallet info used by TeamTnT Wallet info used by TeamTnT[/caption]   [caption id="attachment_20470" align="alignnone" width="2048"]TeamTNT’s official announcement of quitting their operations TeamTNT’s official announcement of quitting their operations[/caption]   [caption id="attachment_20471" align="alignnone" width="640"]Setup script that creates a shell script for the hiding process. Setup script that creates a shell script for the hiding process.[/caption]   [caption id="attachment_20472" align="alignnone" width="622"]SSH credential stealing module SSH credential stealing module[/caption]   Download and installation script for miner [caption id="attachment_20474" align="aligncenter" width="874"]TeamTNT used some buzz covid-19 keywords in their scripts (At the time of Campaign Covid19 was at its peak ) TeamTNT used some buzz covid-19 keywords in their scripts (At the time of Campaign Covid19 was at its peak )[/caption] [caption id="attachment_20475" align="alignnone" width="964"]Setup script for Diamorphine Setup script for Diamorphine[/caption]   [caption id="attachment_20476" align="alignnone" width="1150"]Script of mxutzh.sh Script of mxutzh.sh[/caption]   [caption id="attachment_20477" align="alignnone" width="1114"]Code snippet which infects Docker servers with containers to mine Monero Code snippet which infects Docker servers with containers to mine Monero[/caption]   [caption id="attachment_20478" align="alignnone" width="1150"]<em>Addition in the script to steal more </em>credentials Addition in the script to steal more credentials[/caption]  
CloudSEK Platform is a no-code platform that powers our products with predictive threat analytic capabilities.
Recent Posts

Recent Articles

Critical CSRF Vulnerability in IBM CICS TX - CVE-2023-42027 Demands Immediate Action
November 15, 2023
CVE-2023-43792 baserCMS is a website development framework vulnerable to Code Injection attacks
November 6, 2023

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Dashboard mockup
Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.
Trusted by 400+ Top organisations
Get started
Learn more