Tracking the Activities of TeamTNT: A Closer Look at a Cloud-Focused Malicious Actor Group

Trend Micro's research tracks the activities of the cloud-focused threat actor TeamTNT, outlining its campaigns Covid-19, Black-T, Kinsing Killer, Docker4Mac and AWS credential theft, among others, the range of payloads including cryptocurrency miners, credential stealers, IRC bots, backdoors and the Diamorphine rootkit, and its evolution toward targeting cloud infrastructure and services with credential harvesting and container-focused attacks, accompanied by mitigation recommendations.