Full Report
Investigations into recent campaigns may suggest the reemergence of TeamTNT in 2023 to present day, since evaporating in 2022.
Analysis Summary
# Threat Actor: TeamTNT
## Attribution & Identity
* **Actor Identification:** TeamTNT
* **Aliases:** None specifically mentioned, though they are a well-known prolific cloud-focused threat group.
* **Status:** Reported reemergence in 2023–2024 after a period of inactivity starting in 2022.
* **Confidence Level:** Moderate confidence attribution by Group-IB DFIR experts based on TTP analysis.
## Activity Summary
Recent investigations highlight a campaign targeting publicly accessible cloud instances and Linux servers. The actor utilizes high levels of automation to move from initial access to the deployment of cryptojacking tools and rootkits. The operations are characterized by a "scorched earth" approach to logs and history to prevent recovery and analysis.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of misconfigured or unpatched publicly accessible cloud instances and services (e.g., SSH, Docker, Kubernetes).
* **Persistence:** Use of cron jobs for scheduled execution of malicious scripts.
* **Defense Evasion:**
* Deployment of rootkits to hide malicious processes and files.
* Deletion of bash history (`history -c` and related commands).
* Use of hidden directories (e.g., `/var/tmp/…/`).
* **Privilege Escalation:** Automated scripts to identify and exploit misconfigurations or vulnerabilities to gain root access.
* **Impact:** Resource hijacking for cryptocurrency mining.
* **MITRE ATT&CK IDs (Inferred from text):**
* T1078 (Valid Accounts)
* T1053.003 (Scheduled Task/Job: Cron)
* T1014 (Rootkit)
* T1070.003 (Indicator Removal: Clear Command History)
* T1496 (Resource Hijacking)
## Targeting
* **Sectors:** Industry-agnostic; focuses on any organization with poorly secured cloud infrastructure.
* **Geography:** Global; targeting is opportunistic based on internet-wide scanning.
* **Victims:** Publicly accessible cloud instances, Linux-based servers, and containerized environments.
## Tools & Infrastructure
* **Malware Families:**
* **XMRig:** Open-source Monero miner.
* **Diamorphine:** A LKM (Loadable Kernel Module) rootkit used to hide processes and directories.
* **Custom Tools:**
* `tntrecht`: A specific binary associated with the group's toolset.
* **Infrastructure:**
* **IP Addresses:** `65.108.48[.]150`
* **File Paths:**
* `/etc/.system/rtm/xmrig.log`
* `/var/tmp/…/dia`
* `/var/tmp/…/dia/diamorphine.ko`
* `/usr/bin/tntrecht`
* `/var/tmp/.alsp`
## Implications
The return of TeamTNT signals a renewed threat to cloud environments. Their advanced automation allows them to compromise systems at scale rapidly. The use of kernel-level rootkits like Diamorphine indicates a sophisticated approach to maintaining long-term persistence and evading standard security monitoring tools, potentially leading to significant financial costs due to resource hijacking.
## Mitigations
* **Access Management:** Use key-based SSH authentication exclusively and disable root login.
* **Network Security:** Change default SSH ports to non-standard ranges (e.g., >10000) and restrict access via firewalls to specific IP ranges.
* **Monitoring:** Install and configure `auditd` with DISA-STIG rules, and deploy `AIDE` for file integrity monitoring.
* **Detection:** Use tools like `Fail2Ban` for brute-force protection and `rkhunter` or `PSAD` for rootkit and intrusion detection.
* **Hardening:** Enable SELinux or AppArmor and strictly limit `sudo` access and `cron` job permissions.