Fileless Malware Executing in Containers

Team Nautilus researchers identified a TeamTNT campaign on Docker Hub that performs fileless in-memory attacks in containers: malicious images unpack and execute binaries (Tsunami backdoor and a crypto miner) directly from memory, use an LD_PRELOAD rootkit to hide processes (kthreadd), erase host cron jobs to persist, and connect to C2 and mining pool infrastructure; the report includes dynamic detection methodology, multiple IOCs (image names, file hashes, domains/IPs), and remediation recommendations.