Updated: New Evidence Emerges to Suggest Watch Dog Was Behind Crypto Campaign
Summary: Unit 42 revised its June 8, 2021 attribution, concluding that the domain oracle.zzhreceive[.]top and a cryptojacking campaign it had tied to TeamTNT were instead associated with the group WatchDog. The new WatchDog scripts copy TeamTNT infrastructure naming conventions while using WatchDog's C2 host 199.199.226[.]117, drop the GoLang binaries traditionally linked to WatchDog, and hardcode a Monero wallet address across two mining pools, nanopool[.]org and f2pool[.]com, that TeamTNT had not previously used.
Key Takeaway: WatchDog is mimicking another group's tooling closely enough to mislead attribution, and the same Monero wallet address appears across 19 nanopool samples and 13 f2pool samples - so indicators your team blocked as TeamTNT activity may not cover this operation.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026