
The cryptojacking operation referred to as TeamTNT has most probably resurfaced as a part of a brand new marketing campaign focused on Digital Non-public Server (VPS) infrastructures in response to the CentOS running machine.
โThe preliminary get admission to used to be achieved by the use of a Safe Shell (SSH) brute pressure assault at the suffererโs property, throughout which the danger actor uploaded a malicious script,โ Workforce-IB researchers Vito Alfano and Nam Le Phuong stated in a Wednesday record.
The malicious script, the Singaporean cybersecurity corporate famous, is liable for disabling security measures, deleting logs, terminating cryptocurrency mining processes, and inhibiting restoration efforts.
The assault chains in the end pave the best way for the deployment of the Diamorphine rootkit to hide malicious processes, whilst additionally putting in place continual faraway get admission to to the compromised host.
The marketing campaign has been attributed to TeamTNT with average self belief, bringing up similarities within the ways, ways, and procedures (TTPs) seen.

TeamTNT used to be first found out within the wild in 2019, enterprise illicit cryptocurrency mining actions by means of infiltrating cloud and container environments. Whilst the danger actor bid farewell in November 2021 by means of saying a โblank give up,โ public reporting has exposed a number of campaigns undertaken by means of the hacking staff since September 2022.
The newest process connected to the crowd manifests within the type of a shell script that first assessments if it used to be up to now inflamed by means of different cryptojacking operations, and then it precedes to impair software safety by means of disabling SELinux, AppArmor, and the firewall.
![]() |
Adjustments carried out on ssh provider |
โThe script searches for a daemon associated with the cloud supplier Alibaba, named aliyun.provider,โ the researchers stated. โIf it detects this daemon, it downloads a bash script from replace.aegis.aliyun.com to uninstall the provider.โ
But even so killing all competing cryptocurrency mining processes, the script takes steps to execute a chain of instructions to take away lines left by means of different miners, terminate containerized processes, and take away photographs deployed in reference to any coin miners.
Moreover, it establishes patience by means of configuring cron jobs that obtain the shell script each half-hour from a faraway server (65.108.48[.]150) and enhancing the โ/root/.ssh/authorized_keysโ report so as to add a backdoor account.
โIt locks down the machine by means of enhancing report attributes, making a backdoor consumer with root get admission to, and erasing command historical past to cover its actions,โ the researchers famous. โThe danger actor leaves not anything to probability; certainly, the script implements more than a few adjustments throughout the SSH and firewall provider configuration.โ