TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.123456789
- Palo Alto Black-T October 2020
- Lacework TeamTNT May 2021
- Intezer TeamTNT September 2020
- Cado Security TeamTNT Worm August 2020
- Unit 42 Hildegard Malware
- Trend Micro TeamTNT
- ATT TeamTNT Chimaera September 2020
- Aqua TeamTNT August 2020
- Intezer TeamTNT Explosion September 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | TeamTNT | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1680 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1609 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1610 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1613 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1611 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.009 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1007 | System Service Discovery | — |
| T1014 | Rootkit | — |
| T1016 | System Network Configuration Discovery | — |
| T1021.004 | SSH | — |
| T1027.002 | Software Packing | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1048 | Exfiltration Over Alternative Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1059.009 | Cloud API | — |
| T1059.013 | Container CLI/API | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1098.004 | SSH Authorized Keys | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1136.001 | Local Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1204.003 | Malicious Image | — |
| T1219 | Remote Access Tools | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1496.001 | Compute Hijacking | — |
| T1518.001 | Security Software Discovery | — |
| T1543.002 | Systemd Service | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.001 | Credentials In Files | — |
| T1552.004 | Private Keys | — |
| T1552.005 | Cloud Instance Metadata API | — |
| T1569.003 | Systemctl | — |
| T1583.001 | Domains | — |
| T1587.001 | Malware | — |
| T1595.001 | Scanning IP Blocks | — |
| T1595.002 | Vulnerability Scanning | — |
| T1608.001 | Upload Malware | — |
| T1609 | Container Administration Command | — |
| T1610 | Deploy Container | — |
| T1611 | Escape to Host | — |
| T1613 | Container and Resource Discovery | — |
| T1680 | Local Storage Discovery | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
Aliases
TeamTNT
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.