Loading story…
Palo Alto Networks Unit 42 reported that the WatchDog cryptojacking group, not TeamTNT, was responsible for a cloud-focused intrusion campaign that deliberately imitated TeamTNT tradecraft. Investigators said the operation reused TeamTNT-style infrastructure naming, referenced repositories and domains previously linked to TeamTNT, and relied on the known WatchDog command-and-control host 199.19.226.117 alongside WatchDog-associated Monero wallets and mining pools to deploy illicit cryptocurrency miners.
The findings revise an earlier attribution and indicate that WatchDog expanded its cloud operations while attempting to obscure responsibility by blending in with a better-known threat actor. Unit 42 said the campaign did not match TeamTNT’s more recent behavior, noting the absence of its newer Kubernetes and Docker targeting, credential theft activity, and zgrab usage; it also lacked some of WatchDog’s more advanced Go-based tooling, suggesting a hybrid operation built to look like TeamTNT while retaining identifiable WatchDog infrastructure.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Two malware samples that Unit 42 later tied to WatchDog while imitating TeamTNT tradecraft were first observed on Dec. 5, 2020 and Dec. 11, 2020. The samples used WatchDog-associated infrastructure, wallets, and mining pools while borrowing TeamTNT naming and repository patterns.
Unit 42 reported that new evidence showed a previously reported cloud-focused cryptojacking campaign was conducted by WatchDog rather than TeamTNT. Researchers said WatchDog expanded its operations while deliberately disguising activity to resemble TeamTNT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 96 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamTNT continued to evolve from a Linux-focused cryptojacking group into a broad cloud threat actor targeting exposed Redis, Docker, Kubernetes, Jupyter, Hadoop, PostgreSQL, Tomcat, Nginx, SSH, and other internet-facing services. Researchers tied the group to worm-like campaigns that rapidly scanned for vulnerable hosts, deployed **XMRig** miners, dropped **Tsunami**-based IRC bots including DDoS-capable variants, and used malicious container images on Docker Hub to spread payloads at scale. One TeamTNT-linked Docker Hub account reportedly served images pulled more than **150,000** times, while later campaigns showed the group abusing public registries, compromised accounts, and cloud-native tooling to infect newly exposed systems and report them back to command-and-control infrastructure. Across these operations, TeamTNT consistently paired monetization with aggressive credential theft and stealth. Investigations found the group harvesting **AWS**, Azure, GCP, Kubernetes, Git, NPM, Grafana, database, and storage secrets; stealing SSH keys and host data; and using tools such as Weave Scope, Peirates, BotB, MimiPenguin, Mimipy, `tmate`, and Gsocket to expand access and persistence. Analysts also documented detection evasion through log wiping, process hiding, `LD_PRELOAD` userland rootkits, the **Diamorphine** kernel rootkit, privileged containers with restart policies, and even disabling `runc` to lock out rival attackers, underscoring TeamTNT’s shift from opportunistic mining to sustained compromise of cloud and container environments.
Aug 15, 2026
Researchers reported multiple **TeamTNT** campaigns targeting Docker environments, including a fileless malware operation distributed through malicious Docker Hub images and the **Cetus** cryptojacking worm aimed at exposed Docker daemons on port `2375`. The Docker Hub campaign used four tainted container images to execute payloads directly from memory, helping the malware evade static analysis and some runtime defenses. Analysis found packed binaries, an `LD_PRELOAD` rootkit, **Tsunami** malware, a backdoor, and a cryptominer, with malicious processes disguised as **`kthreadd`** and communications tied to TeamTNT-controlled IRC infrastructure and a **MoneroOcean** mining pool. In a parallel operation, Cetus spread by scanning random subnets with **Masscan**, abusing the Docker REST API through the Docker CLI, and deploying an obfuscated **XMRig** miner to mine Monero. The worm attempted to blend into containerized systems by posing as a fake **Portainer** binary and naming its miner payload **`docker-cache`**. Researchers linked both efforts to TeamTNT through shared infrastructure and wallet reuse, underscoring the group's growing focus on stealthy, cloud-native malware that abuses misconfigured Docker services and container registries for persistence, propagation, and illicit cryptocurrency mining.
Aug 14, 2026
Researchers have linked **TeamPCP** to a broader criminal operation spanning AI infrastructure hijacking and open-source software supply-chain compromise. Oligo Security said infrastructure overlaps tied TeamPCP to aliases including **IronErn** and **TA-NATALSTATUS**, and connected the group to the **ShadowRay 2.0** campaign, which abused Ray’s exposed Jobs API behavior tracked as `CVE-2023-48022` to achieve remote code execution on internet-facing Ray clusters. The campaign turned compromised AI systems into a self-propagating botnet used for CPU and GPU cryptomining, including targeting **NVIDIA A100** resources, while also enabling reverse shells, persistence, data theft, and DDoS activity. Separate threat intelligence reporting said TeamPCP evolved from cloud intrusions and **XMRig**-based Monero mining into a credential-theft-led supply-chain operation that allegedly compromised projects and distribution channels including **Trivy**, **Checkmarx KICS**, **LiteLLM**, the **Telnyx Python SDK**, **Bitwarden CLI**, **Xinference**, and **elementary-data**, and was also linked to an AWS breach affecting the **European Commission**. ThreatMon said the group’s March-April 2026 activity affected more than **1,000 SaaS environments**, exposed roughly **500,000 credentials**, and led to more than **300 GB** of data theft, while newer reporting suggests the actor has likely been active since **2020** and has accelerated its operations by exploiting AI adoption, automation, and trust in open-source ecosystems.
Sep 3, 2026