Unmasking TeamTNT's Silentbob Botnet: Unveiling the Cloud Attack Campaign Infecting 196 Hosts

The cybersecurity landscape is abuzz with concern over the ongoing wave of cloud attacks led by the infamous collective called TeamTNT, whose deployment of the Silentbob botnet has sent shockwaves throughout the industry. Newly emerged reports illuminate the scale and intricacy of their maneuvers, prompting urgent discussions about the safeguarding of cloud infrastructures. In this article, we meticulously explore the inner workings of TeamTNT, their focal points of attack, and the imminent perils confronting businesses and institutions alike.

Expanding Targets and Infections:
TeamTNT's Silentbob botnet has successfully infected a staggering 196 hosts as part of their ongoing cloud campaign. Aqua security researchers Ofek Itach and Assaf Morag have highlighted the group's focus on various high-value targets. These include Docker and Kubernetes environments, Redis servers, Postgres databases, Hadoop clusters, Tomcat and Nginx servers, Weave Scope, SSH, and Jupyter applications.

Shift in Objectives:
Unlike previous campaigns aimed at deploying cryptominers for financial gain, TeamTNT appears to have shifted its objectives to system infection and botnet testing this time. The motive behind this shift in focus is yet to be fully understood. These are key technologies used in software development and deployment:
Docker: An application containerization platform.
Kubernetes: A container orchestration system.
Redis: An in-memory data store.
Postgres: A relational database management system.
Hadoop: A distributed data processing framework.
Tomcat: A Java web application server.
Nginx: A high-performance web server and reverse proxy.
Weave Scope: A container environment monitoring tool.
SSH: Secure remote server access.
Jupyter: An interactive code and data notebook.

Unveiling a Vast Attack Infrastructure:
Recent security investigations have uncovered that TeamTNT's attack infrastructure is more expansive than previously believed. They utilize shell scripts to carry out malicious activities like stealing credentials, deploying SSH backdoors, downloading additional payloads, and employing legitimate tools such as kubectl [Command-line tool for managing Kubernetes clusters], Pacu [AWS exploitation framework for security assessment], and Peirates [Tool for testing and securing Kubernetes clusters] to gather information about cloud environments.

Recent investigations by  Aqua Nautilus  have brought to light a significant development in TeamTNT's cloud attack campaign. It appears that the subdomains on the AnonDNS website are directly associated with TeamTNT and their malicious activities. These subdomains all point to the same cloud native campaign, aimed at infecting systems with their infamous cloud worm.
The following subdomains have been identified as part of this campaign:

1. http[:]//silentbob[.]anondns[.]net
2. http[:]//everlost[.]anondns[.]net
3. http[:]//everfound[.]anondns[.]net
4. http[:]//ap-northeast-1[.]compute[.]internal[.]anondns[.]net

​
Each of these subdomains serves as an entry point for TeamTNT's attack infrastructure, enabling them to target a wide range of cloud environments and vulnerable systems.

Malware Delivery Mechanism:
To expand their botnet's reach, Silentbob utilizes rogue container images hosted on Docker Hub. These images actively scan the internet for misconfigured instances and exploit any newly identified victims with the Tsunami malware. By leveraging a worm script, compromised machines are coerced into becoming part of the botnet, enabling further attacks.

Stealth Techniques and Persistence:
Tsunami, the primary malware employed by TeamTNT, employs the Internet Relay Chat (IRC) protocol to establish communication with a command-and-control (C2) server. Through this channel, the threat actors issue commands to the infected hosts, maintaining a backdoor presence and control. To remain undetected, the botnet employs a rootkit called prochider, effectively concealing its cryptomining activities when system processes are inspected.

Understanding the SCARLETEEL Attack:
SCARLETEEL's assault on AWS infrastructure has raised significant concerns within the cybersecurity community. The attack aims to compromise AWS systems, allowing unauthorized access and potential data breaches. Additionally, the attackers seek to exploit compromised systems by deploying cryptocurrency mining operations, draining resources, and causing financial harm.

TeamTNT's Persistent Threat:
Morag, a lead data analyst, confirms that SCARLETEEL's IP address (45.9.148[.]221) was recently active in TeamTNT's IRC channel C2 server. The similarities in attack scripts and tactics used strongly suggest TeamTNT's involvement in this campaign. It appears that TeamTNT continues its relentless assault on vulnerable targets, never truly ceasing their activities.

Taking Action to Safeguard Your Cloud Environment:
The presence of TeamTNT's Silentbob botnet and its expanding attack infrastructure emphasize the need for businesses to be vigilant in securing their cloud environments. Implementing the following safety measures can help bolster your defense against such sophisticated threats:
1. Strong Access Controls: Implement robust access controls, including strong passwords and multi-factor authentication (MFA), and limit access privileges to necessary users.
2. Regular Updates and Patches: Keep your cloud environment up to date with the latest security patches and promptly address any identified vulnerabilities.
3. Comprehensive Monitoring and Logging: Employ comprehensive monitoring and logging solutions to track activities, detect unauthorized access attempts, and promptly respond to suspicious activities.

Conclusion:
The Silentbob botnet orchestrated by TeamTNT poses a grave threat to the security of cloud environments and the businesses that rely on them. The alarming number of infections and the group's expanding target list emphasize the urgent need for organizations to fortify their defenses.

The Armoryze Approach: Strengthening Your Defense
At Armoryze, a leading cybersecurity company, we recognize the severity of this threat and are dedicated to helping businesses safeguard their cloud infrastructure. Our cutting-edge cloud security solutions provide comprehensive protection against sophisticated attacks like Silentbob. With advanced threat detection systems and proactive monitoring capabilities, we ensure potential vulnerabilities are identified and addressed promptly.

Act now to fortify your defense against threats like the Silentbob botnet. Schedule a FREE consultation with us and experience robust protection. Contact Armoryze today to strengthen your defense and stay one step ahead of cyber threats.