TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations
Summary: Unit 42 reports that TeamTNT is using compromised AWS credentials to enumerate AWS environments through the platform's API, with a script called grab_aws-data.sh containing 70 AWS CLI commands to map IAM permissions, EC2 instances, S3 buckets, CloudTrail configurations and CloudFormation operations. The group is also scraping credentials for 16 additional applications, including Google Cloud credentials - the first known instance of an attacker group targeting IAM credentials outside AWS on compromised cloud instances - and has added the open-source tool Peirates to its reconnaissance.
What's compelling: The group's Monero mining operation has collected 6.52012192 XMR, worth $1,788 at the time of writing, running at 77.7KH/s across eight workers for 114 days - a small haul that shows the cryptojacking is the cover, while the enumeration of IAM, EC2 and S3 permissions is what could hand an actor administrative access to an entire cloud environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026