← Back to Actors
TeamTNT
TeamTNT
[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September...
59
Techniques
57
Covered
2
Gaps
97%
Coverage
Coverage57/59
COVERED (57)
T1007System Service Discovery15 det.T1014Rootkit31 det.T1016System Network Configuration Discovery41 det.T1021.004SSH38 det.T1027.002Software Packing2 det.T1027.013Encrypted/Encoded File8 det.T1036Masquerading672 det.T1036.005Match Legitimate Resource Name or Location49 det.T1046Network Service Discovery53 det.T1048Exfiltration Over Alternative Protocol41 det.T1049System Network Connections Discovery23 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.004Unix Shell177 det.T1059.009Cloud API7 det.T1059.013Container CLI/API1 det.T1070.002Clear Linux or Mac System Logs9 det.T1070.003Clear Command History15 det.T1070.004File Deletion46 det.T1071Application Layer Protocol120 det.T1071.001Web Protocols83 det.T1074.001Local Data Staging10 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1098.004SSH Authorized Keys14 det.T1102Web Service36 det.T1105Ingress Tool Transfer199 det.T1120Peripheral Device Discovery4 det.T1133External Remote Services80 det.T1136.001Local Account46 det.T1140Deobfuscate/Decode Files or Information59 det.T1204.003Malicious Image10 det.T1219Remote Access Tools51 det.T1222.002Linux and Mac Permissions19 det.T1496.001Compute Hijacking2 det.T1518.001Security Software Discovery11 det.T1543.002Systemd Service13 det.T1543.003Windows Service80 det.T1547.001Registry Run Keys / Startup Folder53 det.T1552.001Credentials In Files62 det.T1552.004Private Keys23 det.T1552.005Cloud Instance Metadata API21 det.T1562.001Disable or Modify Tools332 det.T1562.004Disable or Modify System Firewall50 det.T1583.001Domains69 det.T1587.001Malware10 det.T1595.001Scanning IP Blocks7 det.T1595.002Vulnerability Scanning13 det.T1608.001Upload Malware3 det.T1609Container Administration Command36 det.T1610Deploy Container25 det.T1611Escape to Host47 det.T1613Container and Resource Discovery48 det.T1685Disable or Modify Tools281 det.T1685.006Clear Linux or Mac System Logs4 det.T1686Disable or Modify System Firewall19 det.