Analysis of TeamTNT Technique Using Container Images to Attack

Team Nautilus analyzed the Docker Hub account hildeteamtnt tied to TeamTNT and found eight malicious container images used to deploy cryptominers, Docker escape binaries, backdoors, and bind shells; dynamic sandbox execution revealed scripts and binaries that kill competing miners, mount/chroot host filesystems, establish SSH persistence, disable security tools, and conceal activity. The report includes detailed IOCs (domains, IP addresses, MD5 hashes), documents evolving evasive techniques across image versions, and maps the campaign behaviors to the MITRE ATT&CK framework.