Loading story…
Researchers reported that a cloud-focused credential theft campaign broadened beyond AWS to also target Microsoft Azure and Google Cloud Platform, using exposed Docker services as an initial access point. The activity, observed in June 2023 and detailed by SentinelLABS and Permiso, relied on modular shell scripts and a UPX-packed Golang ELF payload to collect cloud credentials, profile compromised hosts, inspect containers, and harvest environment variables from running processes.
The tooling also showed worm-like behavior by scanning for exposed Docker daemons on ports 2375 and 2376 with utilities including masscan and zgrab, then exfiltrating stolen data to AnonDNS-hosted infrastructure protected by hardcoded HTTP credentials. Researchers said the tradecraft overlaps with tooling previously linked to TeamTNT, but stopped short of firm attribution because the scripts are easily reused or modified; they assessed the actor is actively refining the malware for broader cloud-focused operations against Azure and GCP environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
SentinelLABS and Permiso published research describing the campaign's infrastructure, exfiltration methods, and tooling overlaps with activity previously associated with TeamTNT. They said attribution remains uncertain because the scripts are easily reused or modified.
The tooling evolved beyond AWS to also steal credentials from Microsoft Azure and Google Cloud Platform. Researchers said the updated toolset added cloud-specific credential collection, container inspection, environment variable harvesting, and worm-like propagation via scanning exposed Docker daemons on ports 2375 and 2376.
SentinelOne analyzed infrastructure tied to the July 2023 JumpCloud intrusion and assessed that the compromise was linked to a North Korean state-sponsored threat actor. The report cited domain patterns, passive DNS relationships, SSL certificate overlaps, and similarities to TraderTraitor and AppleJeus-linked infrastructure to support the attribution.
Researchers analyzed a cloud credential theft campaign in June 2023 that targeted exposed Docker services to steal AWS credentials. The activity used modular shell scripts and a UPX-packed Golang ELF binary to collect and exfiltrate data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026
Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the **P2PInfect** botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the `SLAVEOF` command and, in some cases, leveraging `CVE-2022-0543` for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads. Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled **TeamPCP** as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, **PCPJack**, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.
Jun 29, 2026
APT41, a China-linked threat group, has deployed a new Linux ELF backdoor from the **Winnti** malware family to compromise cloud workloads and steal credentials from **AWS, Google Cloud, Microsoft Azure, and Alibaba Cloud** environments. Researchers said the implant was built for stealth rather than disruption, harvesting metadata, temporary tokens, and local credential files while evading common detection methods; at the time of analysis, it reportedly had **zero detections on VirusTotal**. The malware abuses cloud metadata services, including the AWS instance metadata endpoint `169.254.169.254`, creating a path to broader cloud access when attached permissions are overly permissive. The campaign uses unusual tradecraft to blend into normal operations, including **SMTP-based command and control over port 25**, a selective handshake mechanism that limits exposure during scanning, and **UDP broadcast beacons on port 6006** that may support lateral movement. Investigators also linked the activity to typosquatted domains themed around **Alibaba Cloud** and **Qianxin**, with infrastructure reportedly registered through NameSilo and hosted in part on Alibaba Cloud in Singapore. Defenders were urged to monitor outbound SMTP from non-mail systems, watch for abnormal UDP broadcasts, audit metadata API access, enforce protections such as **AWS IMDSv2**, and strengthen cloud logging through services such as **CloudTrail** and **Google Cloud Audit Logs**.
Jun 29, 2026