Home / Threat actors / TeamTNT

TeamTNT G0139

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

61

Techniques

4

Malware and tools

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1595.001 Scanning IP Blocks T1595.002 Vulnerability Scanning

Resource Development

T1583.001 Domains T1587.001 Malware T1608.001 Upload Malware

Initial Access

T1133 External Remote Services

Execution

T1059.001 PowerShell T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.009 Cloud API T1059.013 Container CLI/API T1204.003 Malicious Image T1569.003 Systemctl T1609 Container Administration Command T1610 Deploy Container

Persistence

T1098.004 SSH Authorized Keys T1133 External Remote Services T1136.001 Local Account T1543.002 Systemd Service T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1098.004 SSH Authorized Keys T1543.002 Systemd Service T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1611 Escape to Host

Stealth

T1014 Rootkit T1027.002 Software Packing T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.005 Match Legitimate Resource Name or Location T1070.003 Clear Command History T1070.004 File Deletion T1140 Deobfuscate/Decode Files or Information

Defense Impairment

T1222.002 Linux and Mac Permissions T1685 Disable or Modify Tools T1685.006 Clear Linux or Mac System Logs T1686 Disable or Modify System Firewall

Credential Access

T1552.001 Credentials In Files T1552.004 Private Keys T1552.005 Cloud Instance Metadata API

Discovery

T1007 System Service Discovery T1016 System Network Configuration Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1120 Peripheral Device Discovery T1518.001 Security Software Discovery T1613 Container and Resource Discovery T1680 Local Storage Discovery

Lateral Movement

T1021.004 SSH

Collection

T1074.001 Local Data Staging

Command and Control

T1071 Application Layer Protocol T1071.001 Web Protocols T1102 Web Service T1105 Ingress Tool Transfer T1219 Remote Access Tools

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Impact

T1496.001 Compute Hijacking

Malware and tools

HildegardMalwareS0601
LaZagneToolS0349
MimiPenguinToolS0179
PeiratesToolS0683

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.