Threat Alert: Anatomy of Silentbob’s Cloud Attack

Aqua Nautilus researchers uncovered an early-stage, worm-like campaign using malicious Docker Hub images that scan for exposed JupyterLab and Docker APIs to deploy Tsunami backdoor, cryptominers, and credential-harvesting scripts; four malicious images (shanidmk/jltest2, jltest, sysapp, blob) were identified and removed from Docker Hub, Shodan revealed ~51 exposed JupyterLab instances with evidence of exploitation, and the behavior and tooling strongly resemble TeamTNT or a sophisticated copycat — the report includes IoCs, code snippets, observed C2 infrastructure, attribution rationale, and mitigation recommendations.