Threat intelligence / Group

TeamTNT

[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)

60 recorded

Relationships

uses

to Application Layer Protocol

Technique

uses

to Clear Command History

Technique

uses

to Clear Linux or Mac System Logs

Technique

uses

Technique

uses

to Cloud Instance Metadata API

Technique

uses

to Compute Hijacking

Technique

uses

to Container Administration Command

Technique

uses

to Container and Resource Discovery

Technique

uses

to Container CLI/API

Technique

uses

to Credentials In Files

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Deploy Container

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Disable or Modify Tools

Technique

uses

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Escape to Host

Technique

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

Malware

uses

to Ingress Tool Transfer

Technique

uses

Tool

uses

to Linux and Mac Permissions

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious Image

Technique

uses

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Network Service Discovery

Technique

uses

Tool

uses

to Peripheral Device Discovery

Technique

uses

Technique

uses

to Private Keys

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Access Tools

Technique

uses

Technique

uses

to Scanning IP Blocks

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to SSH

Technique

uses

to SSH Authorized Keys

Technique

uses

Technique

uses

to Systemd Service

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Service Discovery

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

10 external

References

mitre-attack

G0139

ATT TeamTNT Chimaera September 2020

https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera

Cado Security TeamTNT Worm August 2020

https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/

Unit 42 Hildegard Malware

https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/

Trend Micro TeamTNT

https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf

Intezer TeamTNT September 2020

https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/

Intezer TeamTNT Explosion September 2021

https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf

Aqua TeamTNT August 2020

https://blog.aquasec.com/container-security-tnt-container-attack

Palo Alto Black-T October 2020

https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/

Lacework TeamTNT May 2021

https://www.lacework.com/blog/taking-teamtnt-docker-images-offline