TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group)

TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.(Citation: Palo Alto Black-T October 2020)|
|mitre-attack|enterprise-attack|IaaS,Containers|T1204.003|Malicious Image|

TeamTNT has relied on users to download and execute malicious Docker images.(Citation: Lacework TeamTNT May 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

TeamTNT has established tmate sessions for C2 communications.(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

TeamTNT has obtained domains to host their payloads.(Citation: Palo Alto Black-T October 2020)|
|mitre-attack|enterprise-attack|Containers|T1610|Deploy Container|

TeamTNT has deployed different types of containers into victim environments to facilitate execution.(Citation: Intezer TeamTNT September 2020)(Citation: Trend Micro TeamTNT)

TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TeamTNT has the