TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.123456789
- Palo Alto Black-T October 2020
- Lacework TeamTNT May 2021
- Intezer TeamTNT September 2020
- Cado Security TeamTNT Worm August 2020
- Unit 42 Hildegard Malware
- Trend Micro TeamTNT
- ATT TeamTNT Chimaera September 2020
- Aqua TeamTNT August 2020
- Intezer TeamTNT Explosion September 2021
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1680 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1609 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1610 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1613 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1611 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1120 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.009 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2021 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1007 | System Service Discovery | — |
| T1014 | Rootkit | — |
| T1016 | System Network Configuration Discovery | — |
| T1021.004 | SSH | — |
| T1027.002 | Software Packing | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036 | Masquerading | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1048 | Exfiltration Over Alternative Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.004 | Unix Shell | — |
| T1059.009 | Cloud API | — |
| T1059.013 | Container CLI/API | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1098.004 | SSH Authorized Keys | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1120 | Peripheral Device Discovery | — |
| T1133 | External Remote Services | — |
| T1136.001 | Local Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1204.003 | Malicious Image | — |
| T1219 | Remote Access Tools | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1496.001 | Compute Hijacking | — |
| T1518.001 | Security Software Discovery | — |
| T1543.002 | Systemd Service | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.001 | Credentials In Files | — |
| T1552.004 | Private Keys | — |
| T1552.005 | Cloud Instance Metadata API | — |
| T1569.003 | Systemctl | — |
| T1583.001 | Domains | — |
| T1587.001 | Malware | — |
| T1595.001 | Scanning IP Blocks | — |
| T1595.002 | Vulnerability Scanning | — |
| T1608.001 | Upload Malware | — |
| T1609 | Container Administration Command | — |
| T1610 | Deploy Container | — |
| T1611 | Escape to Host | — |
| T1613 | Container and Resource Discovery | — |
| T1680 | Local Storage Discovery | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
别名
TeamTNT
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。