MALWARE FAMILY

TeamTNT

Internal ID: elf.teamtnt

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Since Fall 2019, Team TNT is a well known threat actor which targets *nix based systems and misconfigured Docker container environments. It has constantly evolved its capabilities for its cloud-based cryptojacking operations. They have shifted their focus on compromising Kubernetes Clusters.

Threat Analysis

TeamTNT is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.aquasec.com/teamtnt-campaign-against-docker-kubernetes-environment

→https://cybersecurity.att.com/blogs/labs-research/teamtnt-delivers-malware-with-new-detection-evasion-tool

→https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera

→https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf

→https://malpedia.caad.fkie.fraunhofer.de/details/elf.teamtnt

→https://sysdig.com/blog/teamtnt-aws-credentials/

→https://tolisec.com/active-crypto-mining-operation-by-teamtnt/

→https://unit42.paloaltonetworks.com/atoms/adept-libra/

→https://unit42.paloaltonetworks.com/atoms/thieflibra/

→https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.teamtnt

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search TeamTNT