TeamTNT Targeting AWS, Alibaba
Summary: Cisco Talos obtained modified versions of TeamTNT's malicious shell scripts, which the author changed after researchers published an earlier version, and which primarily target AWS but can also run on on-premise, container or other Linux instances. The scripts steal AWS IAM key pairs, mine cryptocurrency at 70% of available CPU, move laterally across Kubernetes pods, and include functions to disable Alibaba cloud security agents such as aliyun-service, cloudmonitor and aegis.
Why it matters: When run on a victim EC2 instance with network traffic blocked, the credential stealer generated no CloudTrail, GuardDuty or SCA events, and because the scripts make no AWS or cloud API calls, none of SCA's Impair Defenses alerts would capture the disabling of Alibaba's agents either.
Read the original at Cisco Talos ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026