Follow the Dynamite: Commemorating TeamTNT's Cloud Attacks
summary
Chronological rundown of TeamTNT shows concrete TTPs: they scan with masscan and zgrab, weaponize exposed Docker APIs to pull Alpine images and chained shell scripts, deploy tsunami DDoS bots, a rathole backdoor and miners, and use wifiscope and mimipenguin for persistent access and credential theft. They compile kernel rootkits (amorphis) or use libprocesshider to hide miners, wrap payloads with izuri to evade AV, and publish a published tooling stash that fuels copycats while claims of 50,000 IPs remain disputed.
AI-written summary · about
chapters (21)
- 0:00Start
- 2:12Intro
- 4:33Winter 2020
- 6:01"Copyright" HildeGard TeamTNT...
- 6:51Hiding Files
- 8:07Credential Stealing
- 8:25Exfil of Stolen Credentials
- 9:40RatHole
- 9:57Oldest Artifact
- 11:33Spring 2020 - Targeting Docker
- 11:53Targeting Exposed Docker Instances
- 12:19Attack Flow
- 12:38Connection to other scripts
- 14:42Rootkit
- 15:08Credential Theft and Lateral Movement
- 15:55Utilizing Legitimate Tools
- 17:31Social Media
- 21:01Winter Summary
- 21:49Sniffer
- 22:09Windows CUDA Miner
- 26:06The Chimaera
related talks
50mThe Anatomy of Cloud Attacks
18mSecuring cloud innovation: Lessons learned
28mBlue Team Fundamentals
39mHow to think like a hacker
39mReal-World Detection Evasion Techniques in the Cloud
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
30mTales of Red Teaming