{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/teamtnt/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["TeamTNT"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS (credentials/config files)"],"_cs_severities":["high"],"_cs_tags":["exfiltration","linux","aws","living-off-the-land"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eSecurity research indicates that the threat group known as TeamTNT actively exploits legitimate Linux binaries to exfiltrate sensitive cloud configuration data. Specifically, attackers use the curl utility to upload AWS credentials (\u003cdel\u003e/.aws/credentials) and configuration files (\u003c/del\u003e/.aws/config) to remote destinations. This technique relies on curl's form-based or direct file upload switches, such as -F, --upload-file, or -T. By exfiltrating these files, the actor gains unauthorized access to the victim's AWS environment, potentially leading to resource theft, crypto-mining deployment, or further network lateral movement. Defenders should monitor process command-line arguments for the combination of curl upload flags and sensitive path references.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial shell access to a Linux-based cloud instance or container.\u003c/li\u003e\n\u003cli\u003eAttacker performs local reconnaissance to locate cloud credentials, typically in ~/.aws/credentials or ~/.aws/config.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the availability of the curl binary on the compromised system.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious curl command utilizing upload switches (-F, --form, -T, or --upload-file) targeting the identified credential files.\u003c/li\u003e\n\u003cli\u003eAttacker executes the curl command, directing the POST request to an attacker-controlled remote endpoint.\u003c/li\u003e\n\u003cli\u003eExfiltrated credentials are received by the attacker's server, enabling cloud resource hijacking.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exfiltration allows for the full compromise of the victim's AWS environment. This exposes the organization to data theft, unauthorized API access, and the deployment of compute-intensive workloads such as cryptominers, which can lead to significant financial costs and infrastructure instability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect curl executions involving sensitive AWS file paths.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive Sysmon for Linux (Event ID 1) or equivalent EDR process-creation telemetry to ensure visibility into command-line arguments.\u003c/li\u003e\n\u003cli\u003eConfigure alerting for all outbound curl traffic to non-authorized domains from cloud-resident Linux hosts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:50:13Z","date_published":"2026-10-12T17:50:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-curl-aws-exfil/","summary":"The TeamTNT threat group leverages the curl utility to exfiltrate sensitive AWS credential and configuration files to remote attacker-controlled servers.","title":"Detection of AWS Credential Exfiltration via Linux Curl","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-curl-aws-exfil/"}],"language":"en","title":"CraftedSignal Threat Feed - TeamTNT","version":"https://jsonfeed.org/version/1.1"}