TeamTNT’s Docker Gatling Gun Campaign (Campaign)

TeamTNT is conducting a campaign that abuses publicly exposed Docker daemons and Docker Hub to deploy cryptominers and the Sliver C2 framework. The group scans for vulnerable hosts (e.g., with Masscan), joins victims to Docker Swarms, and deploys Alpine-based containers hosting malicious payloads; they have transitioned from the Tsunami backdoor to the stealthier Sliver malware, increasing C2 flexibility and persistence.