TeamTNT

TeamTNT, a known threat actor group, has been identified as the force behind an advanced malware campaign targeting Kubernetes. The group's Hildegard malware is one of the most complex attacks seen to date in this area. Despite a common belief that TeamTNT disbanded in 2022, evidence of their activity dating back to 2023 has been discovered. This group is notorious for its cryptojacking attacks, using victims' IT resources to illicitly mine for cryptocurrency. Their tactics, techniques and procedures (TTPs) have shown overlaps with ongoing campaigns from previous years, indicating a consistent and persistent threat. The initial infection vector of the P2PInfect worm exploited Redis through CVE-2022-0543, a method uncommon among other cryptojacking-focused worms. However, similarities between these attacks and those orchestrated by Adept Libra (also known as TeamTNT), Thief Libra (WatchDog), and Money Libra (Kinsing) suggest possible connections. The Hildegard malware, named after the username of the tmate account used by the malware, is believed to be part of a new campaign from TeamTNT. The sophistication of these attacks underscores TeamTNT’s advanced skills in automation and attention to detail, from initial access to thwarting recovery attempts. In 2023, security companies SentinelOne and Aqua Security studied a TeamTNT cryptojacking campaign covering Google Cloud, Microsoft Azure, and Amazon Web Services (AWS). It was reported that TeamTNT mined over $8,100 worth of cryptocurrency from hijacked cloud infrastructure at a cost to their victims of more than $430,000. While this may not seem like significant profit, it does demonstrate the potential financial impact on victims. As such, the cybersecurity community continues to monitor TeamTNT closely, warning of impending Docker attacks and other potential threats.