An analysis of a TeamTNT doppelgänger

This report describes an active opportunistic campaign (observed Nov 2023–Jan 2024) scanning Internet-facing Docker APIs to compromise misconfigured hosts, install backdoors and remote-access tools, steal cloud credentials (AWS/Azure/GCP), create persistent IAM admin users, and deploy XMRig miners while using Linux userland anti-forensics to hide activity; researchers identified hundreds of infected machines, leaked credential lists, C2 infrastructure, and several IOCs (IPs, script hashes, service names, SSH key fingerprints).