# TeamTNT: threat group profile

> TeamTNT is a threat group. Public reporting links it to 42 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/teamtnt
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > TeamTNT

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 42 (plus 30 sub-techniques) |
| Thought to operate from | Not known |
| Other names | 1 |
| Public reports | 10 |

## Who is TeamTNT?

TeamTNT is a threat group. Public reporting links it to 42 attack techniques.

### Also known as

Adept Libra

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> In early Febuary, 2021 TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow dashboards, and Weave Scope, exploiting these environments in order to steal cloud credentials, open backdoors, mine cryptocurrency, and launch a worm that is looking for the next victim. They're linked to the First Crypto-Mining Worm to Steal AWS Credentials and Hildegard Cryptojacking malware. TeamTNT is a relatively recent addition to a growing number of threats targeting the cloud. While they employ some of the same tactics as similar groups, TeamTNT stands out with their social media presence and penchant for self-promotion. Tweets from the TeamTNT’s account are in both English and German although it is unknown if they are located in Germany.

## How does TeamTNT attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 42 linked to TeamTNT. Some techniques belong to more than one stage. Public reporting also lists 30 more specific variations of them, called sub-techniques.

### 1. Research (1)

- T1595: Active Scanning

### 2. Preparation (3)

- T1583: Acquire Infrastructure
- T1587: Develop Capabilities
- T1608: Stage Capabilities

### 3. Getting in (1)

- T1133: External Remote Services

### 4. Running code (5)

- T1059: Command and Scripting Interpreter
- T1204: User Execution
- T1569: System Services
- T1609: Container Administration Command
- T1610: Deploy Container

### 5. Staying in (5)

- T1098: Account Manipulation
- T1133: External Remote Services
- T1136: Create Account
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (4)

- T1098: Account Manipulation
- T1543: Create or Modify System Process
- T1547: Boot or Logon Autostart Execution
- T1611: Escape to Host

### 7. Hiding (5)

- T1014: Rootkit
- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1070: Indicator Removal
- T1140: Deobfuscate/Decode Files or Information

### 8. Disabling defences (3)

- T1222: File and Directory Permissions Modification
- T1685: Disable or Modify Tools
- T1686: Disable or Modify System Firewall

### 9. Stealing passwords (1)

- T1552: Unsecured Credentials

### 10. Looking around (10)

- T1007: System Service Discovery
- T1016: System Network Configuration Discovery
- T1046: Network Service Discovery
- T1049: System Network Connections Discovery
- T1057: Process Discovery
- T1082: System Information Discovery
- T1083: File and Directory Discovery
- T1120: Peripheral Device Discovery
- T1518: Software Discovery
- T1613: Container and Resource Discovery

### 11. Spreading (1)

- T1021: Remote Services

### 12. Gathering data (1)

- T1074: Data Staged

### 13. Keeping contact (4)

- T1071: Application Layer Protocol
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1219: Remote Access Tools

### 14. Taking data out (1)

- T1048: Exfiltration Over Alternative Protocol

### 15. Causing damage (1)

- T1496: Resource Hijacking

## Public reports about TeamTNT

- https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
- https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt
- https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment
- https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool
- https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials
- https://www.intezer.com/blog/cloud-security/top-linux-cloud-threats-of-2020/
- https://www.trendmicro.com/en_us/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html
- https://cyware.com/news/hildegard-teamtnts-new-feature-rich-malware-targeting-kubernetes-6587eb45
- https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/
- https://unit42.paloaltonetworks.com/atoms/adept-libra/

## Frequently asked questions

### Who is TeamTNT?

TeamTNT is a threat group. Public reporting links it to 42 attack techniques.

### How does TeamTNT attack?

Public reporting links TeamTNT to 42 attack techniques. Most of them are about looking around, running code and staying in.

### How do I know if TeamTNT is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact