[Guest Diary] A Deep Dive into TeamTNT and Spinning YARN, (Wed, Dec 18th)

This report analyzes TeamTNT’s "Spinning YARN" campaign that exploits server-side injection and misconfigured services to deliver Linux-focused malware and an XMRig miner; it documents dropper scripts (w.sh, ar.sh), multiple payload binaries (fkoths, bioset, sshd), IoCs (domains, URLs, IPs, and file hashes), and attacker tactics including disabling cloud security, establishing reverse shells, persistence, and potential AWS credential theft.