TeamTNT Deploys Fileless Malware and Cryptojacking Worms Against Docker Environments

Researchers reported multiple TeamTNT campaigns targeting Docker environments, including a fileless malware operation distributed through malicious Docker Hub images and the Cetus cryptojacking worm aimed at exposed Docker daemons on port 2375. The Docker Hub campaign used four tainted container images to execute payloads directly from memory, helping the malware evade static analysis and some runtime defenses. Analysis found packed binaries, an LD_PRELOAD rootkit, Tsunami malware, a backdoor, and a cryptominer, with malicious processes disguised as kthreadd and communications tied to TeamTNT-controlled IRC infrastructure and a MoneroOcean mining pool.

In a parallel operation, Cetus spread by scanning random subnets with Masscan, abusing the Docker REST API through the Docker CLI, and deploying an obfuscated XMRig miner to mine Monero. The worm attempted to blend into containerized systems by posing as a fake Portainer binary and naming its miner payload docker-cache. Researchers linked both efforts to TeamTNT through shared infrastructure and wallet reuse, underscoring the group's growing focus on stealthy, cloud-native malware that abuses misconfigured Docker services and container registries for persistence, propagation, and illicit cryptocurrency mining.