Ankura CTIX FLASH Update - October 29, 2024

Ransomware/Malware Activity

TeamTNT Launches Attacks Compromising Docker for CryptoMining

Researchers have detailed a new attack campaign waged by hacking group TeamTNT that compromises Docker daemons to deploy cryptominers. TeamTNT is a notorious cryptojacking group that has targeted cloud environments for years. This recent campaign uses an attack script called Docker Gatling Gun to search the internet for exposed Docker daemons on specific ports using masscan and ZGrab. A malicious container hosted on a compromised Docker Hub account is deployed on exposed Docker daemons to infect the endpoint with Sliver malware and cryptominers. The campaign has been attributed to TeamTNT due to its characteristics, malware naming conventions, choice of tools, and familiar infrastructure. TeamTNT has been observed diversifying their income stream by renting the compromised infrastructure to other bad actors through a mining rental platform called Mining Rig Rentals. The