TeamTNT Continues to Target Exposed Docker API

Update (2021-11-01) – Attribution for this activity has been disputed and recent analysis by Palo Alto indicates that Watchdog deliberately used TeamTNT tactics to mask their operations. Additionally the use of exploit-laden Golang malware reported in this blog is consistent with Watchdog activity.

Key Takeaways

• Exposed Docker APIs continue to be targeted by TeamTNT
• Docker Hub continues to be leveraged for hosting malicious images.
• TeamTNT’s arsenal expands into Golang brute force utilities.

Caught In The Honeypot – Again!

Lacework Labs recently caught a new TeamTNT Docker image posing as an Apache server targeting exposed Docker APIs in the wild. Upon successful deployment, the Docker image titled “apache” from Docker hub account “docker72590” creates a crontab entry that regularly executes and downloads additional payloads from hXXP://crypto[.]htxrecieve[.]top.

Figure 1 – Cronjob Dropper

At the time of this blog post, the Docker image has 1,900 pulls and has been active under this account since August of 2021.

Figure 2 – Dockerhub Account

Naming Schema TTP

Cross-referencing the domain in the cron entry shows low hits on VirusTotal along with three subdomains of “oracle,” “crypto,” and “pubzone”. This creates overlapping naming schemas of domains and subdomains for a historical link of domains associated with TeamTNT activity, such as  “zzhreceive[.]top”.

Figure 3 – VT Hits

Referencing the older domain “zzhrecieve[.]top”, the URL schema also matches the structure observed in historical open directory staging servers. Figures 4 and 5 below show the similar structure of the “.top” TLD, a sequence of alphanumeric characters followed by an open directory. Lacework Labs suspects that this combination is likely used to avoid web crawlers from indexing the files across common directory structures.

Figure 4 – Domain Similarities

Figure 5 – Opendir Malware Hosting

New Tooling, Same Tricks

Most of the TeamTNT tooling identified in this open directory has been previously reported by industry (XMRig, massscan, pdns scanner). However, a x86 and x64 UPX packed Golang binary called “htx-i-(x86|i686)” containing brute force functionality was identified that Lacework Labs has not previously seen. Additionally, bash scripts included a new ssh key (T1098.004) and a new account (T1136.001) under the name of “lsb” being added to the underlying victim machine.

Figure 6 – Bash Droppers w/ New Accounts & Keys

The Golang binary includes Open Source bindings for Postgresql, Redis, OpenTelemetry as well as custom packages to perform brute force actions against ssh, Postgres and Redis services. The filepath of the adversary’s working environment can be seen in addition to other package artifacts in Figure-6 below.

Figure 7 – Golang Brute Force Paths

Embedded within the binary are several hardcoded usernames/passwords to support the brute force operations of this scan utility.

Figure 8 – Golang Username/Password Combo

XMRig Configs

Also hosted in the open directories were three separate files titled “avg1.tar.gz”, “avg2.tar.gz” and “avg3.tar.gz”. These are in fact not tar files, but JSON files that contain configuration information for the XMRig miner. All of the configuration files had the upstream URL pointing back to the server with the open directory suggesting that a proxy miner may be in use. The use of a Cryptocurrency proxy miner allows a centralized approach for configuration management for multiple miners, such as  controlling which wallet is donated to and what pools to contribute to. XMRig, the popular open source Cryptocurrency miner also has a proxy.

Figure 9 – opendir 2

Figure 10 – XMRig Configs

Conclusion

Adversaries continue to prey on weak passwords and misconfigurations to obtain initial access in cloud environments. Ensuring your systems are hardened against weak credentials, out of date software and are not exposing unauthenticated API endpoints is critical to protect your cloud assets. For more content like this, follow Lacework and Lacework Labs on Twitter and LinkedIn!

IoCs

Copyright 2021 Lacework Inc. All rights reserved.

Categories

• Research