Storm clouds on the horizon: Resurgence of TeamTNT?

This report describes an active TeamTNT campaign targeting CentOS VPS cloud instances via SSH brute force, delivering a multi-stage payload that disables security controls, removes competing miners, installs the Diamorphine kernel rootkit, creates persistent cron-based retrieval of payloads from C2 (65.108.48.150), creates a backdoor SSH user, and locks down system files to prevent recovery; the blog includes actionable IOCs and hardening recommendations for defenders.