Loading story…
Attackers orchestrated a large-scale campaign leveraging stolen credentials to compromise Amazon Web Services (AWS) Simple Email Service (SES) accounts and Portainer instances, enabling the control of over 800 malicious hosts. The campaign, dubbed TruffleNet, utilized the open source TruffleHog tool to systematically test compromised credentials and perform reconnaissance across AWS environments, facilitating business email compromise (BEC) and other malicious activities.
Threat actors exploited Portainer, a legitimate container management tool, as a lightweight control panel to coordinate their infrastructure, making it easier to manage and deploy malicious operations at scale. The campaign highlights the risks associated with exposed cloud management interfaces and the abuse of legitimate DevOps tools for orchestrating attacks, underscoring the need for organizations to secure cloud credentials and restrict access to management dashboards like Portainer.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On November 3, 2025, reporting described the TruffleNet campaign as using stolen credentials to abuse AWS services, including SES, and Portainer-managed infrastructure. The campaign was said to orchestrate more than 800 malicious hosts in support of business email compromise and related malicious activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamTNT abused an exposed Docker API to deploy a privileged Ubuntu container, mount the host filesystem, run cryptominers, and create a privileged SSH user. The group installed the legitimate **Weave Scope** Docker/Kubernetes administration tool, exposing its web dashboard on default port `4040` to map container environments and execute commands—effectively obtaining backdoor-like control through trusted software rather than custom malware. A compromised container can also become a path to cloud-account takeover through instance metadata services, pod IAM/AAD identities, embedded long-term cloud keys, and container escapes. Organizations should restrict Docker APIs and Weave Scope access, prevent pod access to metadata endpoints, enforce least-privilege workload identities and Kubernetes RBAC, eliminate long-term credentials from pods and secrets, remediate vulnerable workloads, and segment networks to limit lateral movement.
Sep 3, 2026
Threat actors are increasingly targeting **network edge infrastructure**—including firewalls, routers, and VPN appliances—by exploiting critical vulnerabilities to gain durable footholds in environments where monitoring is often weaker than on endpoints. Reporting highlights a shift toward persistence mechanisms such as **device-family-specific backdoors** that can survive reboots and even firmware updates, and a growing pattern of abusing **trusted services and upstream providers** (the “**Fail-of-Trust Model**”) to pivot from compromised IT/service vendors into downstream government, military, and critical infrastructure networks. In parallel, a separate large-scale campaign tracked as **TeamPCP** (aka **PCPcat** / **ShellForce**) has been compromising **cloud environments** using automated, worm-like propagation against **misconfigured or exposed management interfaces** rather than novel exploits. Analysis cited in coverage attributes at least **60,000 compromised servers worldwide** to the operation, which scans for and abuses exposed services such as **Docker APIs**, **Kubernetes** control surfaces, **Redis**, and other cloud-adjacent interfaces, turning hijacked infrastructure into monetizable “crime bots” through industrialized exploitation of known weaknesses and misconfigurations.
Jun 29, 2026
TeamTNT continued to evolve from a Linux-focused cryptojacking group into a broad cloud threat actor targeting exposed Redis, Docker, Kubernetes, Jupyter, Hadoop, PostgreSQL, Tomcat, Nginx, SSH, and other internet-facing services. Researchers tied the group to worm-like campaigns that rapidly scanned for vulnerable hosts, deployed **XMRig** miners, dropped **Tsunami**-based IRC bots including DDoS-capable variants, and used malicious container images on Docker Hub to spread payloads at scale. One TeamTNT-linked Docker Hub account reportedly served images pulled more than **150,000** times, while later campaigns showed the group abusing public registries, compromised accounts, and cloud-native tooling to infect newly exposed systems and report them back to command-and-control infrastructure. Across these operations, TeamTNT consistently paired monetization with aggressive credential theft and stealth. Investigations found the group harvesting **AWS**, Azure, GCP, Kubernetes, Git, NPM, Grafana, database, and storage secrets; stealing SSH keys and host data; and using tools such as Weave Scope, Peirates, BotB, MimiPenguin, Mimipy, `tmate`, and Gsocket to expand access and persistence. Analysts also documented detection evasion through log wiping, process hiding, `LD_PRELOAD` userland rootkits, the **Diamorphine** kernel rootkit, privileged containers with restart policies, and even disabling `runc` to lock out rival attackers, underscoring TeamTNT’s shift from opportunistic mining to sustained compromise of cloud and container environments.
Aug 15, 2026