TeamTNT executed

Hildegard through the kubelet API run command and by executing commands on running containers.(Citation: Unit 42 Hildegard Malware)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.(Citation: Intezer TeamTNT September 2020)(Citation: Cisco Talos Intelligence Group)

TeamTNT has also targeted exposed kubelets for Kubernetes environments.(Citation: Unit 42 Hildegard Malware)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

TeamTNT has used SSH to connect back to victim machines.(Citation: Intezer TeamTNT September 2020)

TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|

TeamTNT has deployed XMRig Docker images to mine cryptocurrency.(Citation: Lacework TeamTNT May 2021)(Citation: Cado Security TeamTNT Worm August 2020)

TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

TeamTNT has uploaded backdoored Docker images to Docker Hub.(Citation: Lacework TeamTNT May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

TeamTNT has created local privileged users on victim machines.(Citation: Intezer TeamTNT September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|