{
  "id": "teamtnt",
  "name": "TeamTNT",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Cryptojacking group",
      "src": [
        "mitre-g0139"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2019,
      "src": [
        "mitre-g0139"
      ],
      "conf": "medium",
      "note": "At least 2019"
    },
    {
      "k": "attack_id",
      "v": "G0139",
      "src": [
        "mitre-g0139"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "TeamTNT is a threat group that has primarily targeted cloud and containerized environments.",
      "src": [
        "mitre-g0139"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 56,
      "src": [
        "mitre-g0139"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Hildegard, LaZagne, MimiPenguin, Peirates",
      "src": [
        "mitre-g0139"
      ],
      "conf": "high",
      "note": "4 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0139)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/teamtnt.html",
  "sources": {
    "mitre-g0139": {
      "title": "TeamTNT, Group G0139",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0139/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}