News and Analysis

Cryptojacking group TeamTNT is preparing a large-scale attack targeting cloud-native environments for mining cryptocurrencies and renting breached servers to others. TeamTNT is diversifying its monetization strategy, including offering victims’ computational power for illegal cryptocurrency mining. The group uses Docker daemons to deploy Sliver malware and cryptominers, using compromised servers and Docker Hub as infrastructure to spread malware. The attack method involves using unauthenticated and exposed Docker API endpoints for cryptominer deployment and selling compromised infrastructures on rental platforms.