TeamTNT's Silentbob Botnet Infecting 196 Hosts in Cloud Attack Campaign

TeamTNT's Silentbob Botnet Infecting 196 Hosts in Cloud Attack Campaign. TeamTNT focuses on Docker, Kubernetes, Redis, Postgres, Hadoop, Tomcat, Nginx, Weave Scope, SSH, and Jupyter applications. Not a profit-driven campaign. Exploits exposed JupyterLab and Docker APIs to deploy Tsunami malware for cryptocurrency mining. Utilizes rogue container images on Docker Hub to infect new victims at an impressive speed. Uses IRC protocol for C2 communication and hides cryptomining execution with a rootkit called prochider