Categories: News

Attackers transformed cloud monitoring tools into backdoor

The group known as TeamTNT managed to turn cloud monitoring tools into a backdoor. Thus, they performed malicious attacks.

TeamTNT usually targets cloud environments, including Docker and Kubernetes.

Monitoring tools, used for the first time

The cybersecurity company Intezer discovered the new attacks. ”To our knowledge, this is the first time attackers have been caught using legitimate third party software to target cloud infrastructure,” the company announced.

So, TeamTNT managed to map the cloud environment of their victims and also execute malicious code. And they did it without having to deploy malicious code on the target servers. Instead, they used a visualization and monitoring tool for Docker and Kubernetes services, called Weave Scope.

They installed crytpocurrency mining malware

The group has been known to be active since late April 2020 and they have been usually directing their attacks on misconfigured Docker ports. Through these, they installed crytpo-mining malware and also a DdoS (Distribute Denial-of-Service) bot.

In July, they managed to steal Amazon Web Services logins. To do this, they infected the Docker and Kubernetes systems for sensitive data in the AWS credentials and config files.

They changed the method of gaining control of the infected infrastructure. So, as soon as they found the way in, they used a clean Ubuntu image in order to set up a privileged container. Then they used it to gain root access by creating a privileged user. With it, they connected to the server and eventually installed Weave Scope.

Using this legitimate tool, “ the attakcers reap all the benefits as if they had installed a bakdoor on the server”, Nicole Fishbein, from Intezer, mentioned. And all this without having to use mallware.

What to do?

The security experts mentioned that there is a way to stay safe in front of such attacks.

“Weave Scope uses default port 4040 to make the dashboard accessible and anyone with access to the network can view the dashboard. Similar to the Docker API port, this port should be closed or restricted by the firewall,” the cybersecurity firm said.

Users should take these steps because although the goal of the team is to generate cash via crytpcurrency mining. Still, there were groups that managed to used cryptojacking worms to compromise enterprise systems.

In order to prevent attackers from taking control over the servers, companies should restrict access to Docker API endpoints.

Laurentiu Titei

Recent Posts

Best Alternatives to Avira Antivirus to use on Windows PC

Avira antivirus is a popular antivirus software that you may have come across or may…

11 hours ago

How to Deactivate and Delete a Facebook Account in 2025

2004 brought the world together in a book, the social network Facebook. Within a few…

12 hours ago

What is ExitLag and How to Download ExitLag for Windows

Imagine you are playing Counter-Strike 2, glued to your computer screen. When all things were…

17 hours ago

Best Free PC Games Download Sites (Latest 2025)

Tired from your studies, office job, or any other hectic task? Then, you can turn…

24 hours ago

Best Game Boosters | Game Optimizers for Windows 2025

In this guide, we will have a look at some of the best game booster…

24 hours ago

XP Pen Drivers Download and Install on Windows 10/11

Let’s have a look at different methods to download and update the XP pen drivers…

24 hours ago