LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0139: TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

EnterpriseG0139GroupObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0139: TeamTNT describes [TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard ...

Executive priority

G0139: TeamTNT is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0139: TeamTNT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0139: TeamTNT appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

56 rows
DomainIDNameRelationship / procedure
EnterpriseT1680Local Storage Discovery

TeamTNT has searched for disk partition and logical volume information.[7]CitationCisco Talos Intelligence Group

EnterpriseT1686Disable or Modify System Firewall

TeamTNT has disabled iptables.[8]

EnterpriseT1133External Remote Services

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.[3]CitationCisco Talos Intelligence Group TeamTNT has also targeted exposed kubelets for Kubernetes environments.[5]

EnterpriseT1219Remote Access Tools

TeamTNT has established tmate sessions for C2 communications.[5]CitationCisco Talos Intelligence Group

EnterpriseT1569.003SystemctlSub-technique

TeamTNT has created system services to execute cryptocurrency mining software.CitationCisco Talos Intelligence Group

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.CitationCisco Talos Intelligence Group

EnterpriseT1222.002Linux and Mac PermissionsSub-technique

TeamTNT has modified the permissions on binaries with chattr.[6]CitationCisco Talos Intelligence Group

EnterpriseT1070.004File DeletionSub-technique

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.[7]CitationCisco Talos Intelligence Group

EnterpriseT1609Container Administration Command

TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.[5]

EnterpriseT1059.004Unix ShellSub-technique

TeamTNT has used shell scripts for execution.[6]CitationCisco Talos Intelligence Group

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

TeamTNT has added batch scripts to the startup folder.[7]

EnterpriseT1543.002Systemd ServiceSub-technique

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.[6]CitationCisco Talos Intelligence Group

EnterpriseT1136.001Local AccountSub-technique

TeamTNT has created local privileged users on victim machines.[3]

EnterpriseT1007System Service Discovery

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.CitationCisco Talos Intelligence Group

EnterpriseT1049System Network Connections Discovery

TeamTNT has run netstat -anp to search for rival malware connections.[6] TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.[7]

EnterpriseT1543.003Windows ServiceSub-technique

TeamTNT has used malware that adds cryptocurrency miners as a service.[7]

EnterpriseT1608.001Upload MalwareSub-technique

TeamTNT has uploaded backdoored Docker images to Docker Hub.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.[7]

EnterpriseT1610Deploy Container

TeamTNT has deployed different types of containers into victim environments to facilitate execution.[3][6] TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.CitationCisco Talos Intelligence Group

EnterpriseT1613Container and Resource Discovery

TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.[6] TeamTNT has also searched for Kubernetes pods running in a local network.CitationCisco Talos Intelligence Group

EnterpriseT1048Exfiltration Over Alternative Protocol

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.CitationCisco Talos Intelligence Group

EnterpriseT1057Process Discovery

TeamTNT has searched for rival malware and removes it if found.[6] TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.CitationCisco Talos Intelligence Group

EnterpriseT1059.001PowerShellSub-technique

TeamTNT has executed PowerShell commands in batch scripts.[7]

EnterpriseT1552.005Cloud Instance Metadata APISub-technique

TeamTNT has queried the AWS instance metadata service for credentials.[6]CitationCisco Talos Intelligence Group

EnterpriseT1070.003Clear Command HistorySub-technique

TeamTNT has cleared command history with history -c.[6]CitationCisco Talos Intelligence Group

EnterpriseT1074.001Local Data StagingSub-technique

TeamTNT has aggregated collected credentials in text files before exfiltrating.CitationCisco Talos Intelligence Group

EnterpriseT1595.002Vulnerability ScanningSub-technique

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.[6]

EnterpriseT1059.013Container CLI/APISub-technique

TeamTNT targeted misconfigured containers and used container CLI tools.CitationCisco Talos Blog

EnterpriseT1027.002Software PackingSub-technique

TeamTNT has used UPX and Ezuri packer to pack its binaries.[6]

EnterpriseT1204.003Malicious ImageSub-technique

TeamTNT has relied on users to download and execute malicious Docker images.[2]

EnterpriseT1014Rootkit

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.[6] CitationCisco Talos Intelligence Group

EnterpriseT1552.004Private KeysSub-technique

TeamTNT has searched for unsecured SSH keys.[4][6]

EnterpriseT1611Escape to Host

TeamTNT has deployed privileged containers that mount the filesystem of victim machine.[3][8]

EnterpriseT1595.001Scanning IP BlocksSub-technique

TeamTNT has scanned specific lists of target IP addresses.[6]

EnterpriseT1105Ingress Tool Transfer

TeamTNT has the curl and wget commands as well as batch scripts to download new tools.[3]CitationCisco Talos Intelligence Group

EnterpriseT1518.001Security Software DiscoverySub-technique

TeamTNT has searched for security products on infected machines.[7]CitationCisco Talos Intelligence Group

EnterpriseT1496.001Compute HijackingSub-technique

TeamTNT has deployed XMRig Docker images to mine cryptocurrency.[2][4] TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.CitationCisco Talos Intelligence Group

EnterpriseT1083File and Directory Discovery

TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.CitationCisco Talos Intelligence Group

EnterpriseT1021.004SSHSub-technique

TeamTNT has used SSH to connect back to victim machines.[3] TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.CitationCisco Talos Intelligence Group

EnterpriseT1036Masquerading

TeamTNT has disguised their scripts with docker-related file names.CitationCisco Talos Intelligence Group

EnterpriseT1140Deobfuscate/Decode Files or Information

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.CitationCisco Talos Intelligence Group

EnterpriseT1082System Information Discovery

TeamTNT has searched for system version, architecture, and hostname information.[7]CitationCisco Talos Intelligence Group

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

TeamTNT has encrypted its binaries via AES and encoded files using Base64.[6][8]

EnterpriseT1016System Network Configuration Discovery

TeamTNT has enumerated the host machine’s IP address.[6]

EnterpriseT1046Network Service Discovery

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.[4][5]CitationCisco Talos Intelligence Group TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.[1]

EnterpriseT1120Peripheral Device Discovery

TeamTNT has searched for attached VGA devices using lspci.CitationCisco Talos Intelligence Group

EnterpriseT1685Disable or Modify Tools

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.[7]CitationCisco Talos Intelligence Group

EnterpriseT1071Application Layer Protocol

TeamTNT has used an IRC bot for C2 communications.[6]

EnterpriseT1098.004SSH Authorized KeysSub-technique

TeamTNT has added RSA keys in authorized_keys.[8]CitationCisco Talos Intelligence Group

EnterpriseT1583.001DomainsSub-technique

TeamTNT has obtained domains to host their payloads.[1]

EnterpriseT1059.009Cloud APISub-technique

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.CitationTalos TeamTNT

EnterpriseT1071.001Web ProtocolsSub-technique

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software.[3][4]CitationCisco Talos Intelligence Group TeamTNT has also used a custom user agent HTTP header in shell scripts.[6]

EnterpriseT1552.001Credentials In FilesSub-technique

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.[4][6]CitationCisco Talos Intelligence Group

EnterpriseT1685.006Clear Linux or Mac System LogsSub-technique

TeamTNT has removed system logs from /var/log/syslog.[8]

EnterpriseT1587.001MalwareSub-technique

TeamTNT has developed custom malware such as Hildegard.[5]

EnterpriseT1102Web Service

TeamTNT has leveraged iplogger.org to send collected data back to C2.[8]CitationCisco Talos Intelligence Group

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0683: Peirates

Peirates is a post-exploitation Kubernetes exploitation framework with a focus on gathering service account tokens for lateral movement and privilege escalation. The tool is written in GoLang and publicly available on GitHub.[1]

Containers
ToolEnterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
MalwareEnterprise

S0601: Hildegard

Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard. [1]

LinuxContainersIaaS
Relationship explorer

All related ATT&CK context

uses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1686: Disable or Modify System FirewallEnterpriseuses · TechniqueT1133: External Remote ServicesEnterpriseuses · TechniqueT1219: Remote Access ToolsEnterpriseuses · TechniqueT1569.003: SystemctlEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1222.002: Linux and Mac PermissionsEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1609: Container Administration CommandEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1543.002: Systemd ServiceEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1608.001: Upload MalwareEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1610: Deploy ContainerEnterpriseuses · TechniqueT1613: Container and Resource DiscoveryEnterpriseuses · TechniqueT1048: Exfiltration Over Alternative ProtocolEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1552.005: Cloud Instance Metadata APIEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.4
Created
Modified
Raw hash
a808598bb9b8eb37...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.4Current bundlea808598bb9b8…
19.21.4Older bundlea808598bb9b8…
19.11.4Older bundle352e6bff7c7e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Palo Alto Black-T October 2020

    Quist, N. (2020, October 5). Black-T: New Cryptojacking Variant from TeamTNT. Retrieved September 22, 2021.

    Open source URL
  2. [2]
    Lacework TeamTNT May 2021

    Stroud, J. (2021, May 25). Taking TeamTNT's Docker Images Offline. Retrieved September 16, 2024.

    Open source URL
  3. [3]
    Intezer TeamTNT September 2020

    Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.

    Open source URL
  4. [4]
    Cado Security TeamTNT Worm August 2020

    Cado Security. (2020, August 16). Team TNT – The First Crypto-Mining Worm to Steal AWS Credentials. Retrieved September 22, 2021.

    Open source URL
  5. [5]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  6. [6]
    Trend Micro TeamTNT

    Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.

    Open source URL
  7. [7]
    ATT TeamTNT Chimaera September 2020

    AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.

    Open source URL
  8. [8]
    Aqua TeamTNT August 2020

    Kol, Roi. Morag, A. (2020, August 25). Deep Analysis of TeamTNT Techniques Using Container Images to Attack. Retrieved September 22, 2021.

    Open source URL
  9. [9]
    Intezer TeamTNT Explosion September 2021

    Intezer. (2021, September 1). TeamTNT Cryptomining Explosion. Retrieved October 15, 2021.

    Open source URL
  10. [10]
    mitre-attackG0139
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use