[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/teamtnt-cryptojacking-watchdog-operations/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/teamtnt-cryptojacking-watchdog-operations/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/ "Cloud Cybersecurity Research")  
  [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/)

# Updated: New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 9 min read  
Related Products  
[![Network Security CN-Series icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Network Security CN-Series](https://unit42.paloaltonetworks.com/product-category/network-security-cn-series/ "Network Security CN-Series")[![Next-Generation Firewall VM series icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall VM series](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall-vm-series/ "Next-Generation Firewall VM series")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Nathaniel Quist](https://unit42.paloaltonetworks.com/author/nathaniel-quist/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:October 29, 2021

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/)
  * [Cybercrime](https://unit42.paloaltonetworks.com/category/cybercrime/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/)
  * [Monero](https://unit42.paloaltonetworks.com/tag/monero/)
  * [TeamTnT](https://unit42.paloaltonetworks.com/tag/teamtnt/)
  * [WatchDog](https://unit42.paloaltonetworks.com/tag/watchdog/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/teamtnt-cryptojacking-watchdog-operations/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/teamtnt-cryptojacking-watchdog-operations/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Updated:%20New%20Evidence%20Emerges%20to%20Suggest%20WatchDog%20Was%20Behind%20Crypto%20Campaign&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F&title=Updated:%20New%20Evidence%20Emerges%20to%20Suggest%20WatchDog%20Was%20Behind%20Crypto%20Campaign "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F&text=Updated:%20New%20Evidence%20Emerges%20to%20Suggest%20WatchDog%20Was%20Behind%20Crypto%20Campaign "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Updated:%20New%20Evidence%20Emerges%20to%20Suggest%20WatchDog%20Was%20Behind%20Crypto%20Campaign%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fteamtnt-cryptojacking-watchdog-operations%2F "Share in Mastodon")

## Author's Note

New evidence has emerged that suggests the group WatchDog was behind a cryptojacking campaign that we attributed to TeamTNT in a blog published on June 8, 2021. This updated information changed our view on the evidence initially gathered by Unit 42 researchers.

Specifically, the domain oracle.zzhreceive\[.\]top was originally linked to TeamTNT operations due to the usage of the term zzhreceive, which has been witnessed within several TeamTNT operations. Given recent developments and the growing analytic visibility within the cloud research community, this domain has now been attributed to the cryptojacking operations associated with the group WatchDog. The following is an update of our original blog, more accurately aligned to the current intelligence community information regarding WatchDog's mimicry of TeamTNT operations.

## Executive Summary

The copying and incorporation of cryptomining operational codebase or script functions have become a central behavioral indicator of cryptojacking groups and their operations. Unit 42 researchers have identified tactics, techniques and procedures (TTPs) used by the [TeamTNT cryptojacking group](https://unit42.paloaltonetworks.com/atoms/teamtnt/) being used by the [WatchDog cryptojacking group](https://unit42.paloaltonetworks.com/watchdog-cryptojacking/). The new scripts from WatchDog are overtly copying TeamTNT infrastructure naming conventions and using a known WatchDog C2 hosting system, 199.199.226\[.\]117.

With the identification of these new WatchDog scripts, Unit 42 researchers found that techniques that have been synonymous with the TeamTNT group have gone missing. For instance, the new scripts do not:

* Use the latest attack patterns, Kubernetes (K8s) or Docker API targeting, which were featured in two reports focusing on TeamTNT operations, [Black-T: New Cryptojacking Variant from TeamTNT](https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/) and [Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes](https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/).
* Exfiltrate any identified credentials found on the compromised cloud instances.
* Use the network scanning tool zgrab.

Researchers have also observed that the new WatchDog scripts do not use the exploit-laden GoLang binaries traditionally associated with WatchDog.

While WatchDog is believed to be the author of these new scripts, several of the scripts were found within TeamTNT-owned public malware repositories. It appears that WatchDog may be attempting to expand their cryptojacking operations, while simultaneously masking their operations to appear more like the known cryptojacking operations performed by TeamTNT.

The stealing, hijacking or incorporation of cryptojacking TTPs within other cryptojacking operations has become a common trend within cryptojacking groups. Most notably, TeamTNT was reported to have copied the code used to detect and remove Alibaba Cloud Security from compromised instances from the [Kinsing group](https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials). Also, cryptojacking groups such as "Rocke" [began as a forked GitHub repository](https://blog.talosintelligence.com/2018/12/cryptomining-campaigns-2018.html) from the cryptojacking operation created by "The 8220 Mining Group." This operation [shares up to 30% of its cryptomining code base](https://csirt.cy/en/pacha-group-competing-against-rocke-group-for-cryptocurrency-mining-foothold-on-the-cloud/) with tools developed by the group "Pacha." Pacha and Rocke were subsequently involved in a documented [crypto war](https://securityaffairs.co/wordpress/85400/hacking/pacha-group-crypto-mining.html), which has lasted nearly two years. While little research has been written on recent Pacha operations, Rocke is still developing [new malware](https://unit42.paloaltonetworks.com/pro-ocean-rocke-groups-new-cryptojacking-malware/).

Palo Alto Networks customers running[Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) are protected from the threats presented in this report through the Runtime Protection feature, Cryptominer Detection feature and the Prisma Cloud Compute Kubernetes Compliance Protection, which alerts on an insufficient Kubernetes configuration and provides secure alternatives. Additionally, Palo Alto Networks [VM-Series](https://www.paloaltonetworks.com/prisma/vm-series) and [CN-Series](https://www.paloaltonetworks.com/network-security/cn-series) products offer cloud protections that can prevent network connections from cloud instances toward known malicious IP addresses and URLs.

## New WatchDog Malware

There are two samples that show the evolution of WatchDog techniques to mimic TeamTNT operations, 36ca9f84864ad022c255b7d91e75997f035716e4df5dc1c90ee2651f092f5d79 and 49366ae4766492d94136ca1f715a37554aa6243686c66bf3c6fbb9da9cb2793d. These samples, first witnessed on Dec. 5 and 11, 2020, respectively, show the direct replacement of the known WatchDog C2 infrastructure with new C2 infrastructure. As shown in Figure 1, the original WatchDog infrastructure, in the dark blue rectangle, has been commented out of the bash script functionality and replaced with the new infrastructure seen in the light blue rectangle.
![The original WatchDog infrastructure, in the dark blue rectangle, has been commented out of the bash script functionality and replaced with the new infrastructure seen in the light blue rectangle.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-21.png) Figure 1. WatchDog infrastructure replacement.

The new script also makes use of the exact URL address directory tree pattern that is present within the known WatchDog operations, with the directories b2f628 (red) and b2f628fff19fda999999999 (orange), as shown in Figure 2.
![The new script also makes use of the exact URL address directory tree pattern that is present within the known WatchDog operations, with the directories b2f628 (outlined in red) and b2f628fff19fda999999999 (outlined in orange).](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-22.png) Figure 2. URL directory pattern.

These two samples contain a hardcoded Monero (XMR) wallet address and an associated mining pool, as shown in Figure 3.
![These two samples contain a hardcoded Monero (XMR) wallet address and an associated mining pool.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-23.png) Figure 3. Monero wallet and associated mining pool.

#### Mining Pools

If these changes are indeed new TeamTNT behaviors, which is highly unlikely, it would represent the first time the TeamTNT cryptojacking operations have used a mining pool outside their traditional Monero mining pool, MoneroOcean\[.\]stream. This cryptojacking operation introduces two new mining pools never before known to be used by TeamTNT actors, but have been witnessed within WatchDog operations. These mining pools are nanopool\[.\]org, shown in Figure 4, and f2pool\[.\]com, shown in Figure 5. The new mining pools are both instructed to use the Monero wallet address, 43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZWi44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9N5PepeajfmKp1X71EW7jx4Tpz.

![This cryptojacking operation introduces two new mining pools never before known to be used by TeamTNT actors, including nanopool\[.\]org, shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-24.png) Figure 4. Nanopool mining operation. ![This shows the total revenue and other details observed in f2pool.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-25.png)

![This cryptojacking operation introduces two new mining pools never before known to be used by TeamTNT actors, including f2pool\[.\]com, shown here.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-26.png) Figure 5. F2pool mining operation.

#### Mining Pool Worker Information

Of note are the names of the mining pool workers associated with this Monero wallet address within the mining pools. According to nanopool\[.\]org records related to this Monero wallet address, there are a total of 20 unique workers, as shown in Figure 6.

![According to nanopool\[.\]org records related to this Monero wallet address, there are a total of 20 unique workers.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-27.png) Figure 6. Nanopool mining operation workers. The following table, Table 1, lists 19 of the currently known malicious samples which contain the Monero wallet address, the Nanopool mining pool and the name of one of the workers listed within Figure 6.

|------------------------------------------------------------------|------------|
| **SHA256**                                                       | **Worker** |
| 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 | 3910       |
| 34b547b567309618422d7075322ddf5b9e0b3a4fb652f3845d12fd649f23923e | 3910       |
| 62957aa4421c044927269e9bf3300515cf01225fd4c3c3811f8ebfac7a9f8585 | 3910       |
| f235c021baa6c8801e724d45003b1b1541eea5483810abc9c3eb4df6bf05afbf | 3910       |
| 2bc6c21d35ed63b135b4723444a9ac532e4cb6aaa2bbd63c557136edb4e4756f | crondk1    |
| cbf54a9e5771fcb3760e4e282f003a879164e76b9df9fed0fe4e4e8aaaef11ae | crondk1    |
| 428633aee75f7c69a7c0612e591d5fcecbcf13619d6c05b86c8303a248c7c8d7 | dk2        |
| 7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889 | dk2        |
| 10fb8d16f7d168340be28c6d0ba94e10c15370c8747d97bc0e5fad4b4466cf09 | dream      |
| 3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad | dream      |
| 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6 | dream      |
| af611a41c55e9afcfaced8b067a470caa70825fce0a44167f44a8d3880ae6674 | dream      |
| e1d7014b84618cd7fbf94439c78fe7d67f351cbc5536885fa3d94ea15325d83b | dream      |
| eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990c | dream      |
| ae6822d1fd097e8c52cea3731cd49f50600b7da83e9f0ea6dbc689685f907739 | dream3     |
| 3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad | dream5     |
| ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a | dream6     |
| 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6 | dream8     |
| 33da23085fb6fd7aad89e0c55b7ccbc2ee50fec4e8e31030e4b2a4ef034ac5f6 | pokemon2   |

^*Table 1. Malware samples with hardcoded Nanopool mining operation workers.*^

There were also 13 malicious samples containing the 43Xb Monero wallet address, but these samples are designed to use the f2pool\[.\]com mining pool instead of the nanopool\[.\]org Monero mining pool (see Table 2).

|------------------------------------------------------------------|------------|---------------------|
| **SHA256**                                                       | **Worker** | **WatchDog Wallet** |
| f235c021baa6c8801e724d45003b1b1541eea5483810abc9c3eb4df6bf05afbf | 3910       |                     |
| 3d8a6f5d8162e8eb78e7b95384ec6418f65b904dffa8fd983a6a19a5645ad707 | clean      |                     |
| c141eaeab461a2481124a73ee2d254301573d8722dbf3221f5fc54d7770e67a2 | clean      | Yes                 |
| 64072e7c56895f59124c4e26e0dd65a4de0bd8280c83372c18f9835978cda0e9 | clean      |                     |
| 30f0207b74d6d2d17cd8f4dc9f9131bd8763702f19c87ce74ea13a634f52c995 | clean      | Yes                 |
| 7a8c91f4228be4d36e1087acc9bb046373ddfde506fe4645ad1b0967c08bfa8b | clean      | Yes                 |
| 7848fc64c9977796dcc0ee67c293f006d715d3b3e257a3c0f4654cefab637c45 | clean      | Yes                 |
| 3e6cf5ae8ce6ff7305da4e218a20ec7f57933235ec07d7ff6e6a18c7c844ff29 | clean      | Yes                 |
| 8d9bdcae4a4559e52b3d03209a1ef880e948d9f3969f7779119d9322c5f7cf7c | clean      | Yes                 |
| ab73aedbee66081cd047b19a4bb036f85791a9ae9abc90545c5d8756bbc2a428 | clean      | Yes                 |
| eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990c | dream      |                     |
| e47802d7f44fc9e594b89ef33298367d21695d5ec1ae5e6c526b9f3124c555ca | Undefined  |                     |
| cf890e288f4fb7a2cfb0aa7e91229cc51c224e767c6ca69bbbb9d06e999ede64 | Undefined  |                     |

^*Table 2. Malware samples with hardcoded f2pool mining pool operation workers.*^

Seven samples within the previous table contain instructions to find and remove any processes using the WatchDog-identified 43XB Monero wallet address, as shown in Figure 7.
![Seven samples within the previous table contain instructions to find and remove any processes using the TeamTNT-identified 43XB Monero wallet address.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-28.png) Figure 7. Identification and killing of processes using the WatchDog Monero address.

The scripts will then rebuild mining operations and begin using two known WatchDog Monero wallet addresses, 82etS8QzVhqdiL6LMbb85BdEC3KgJeRGT3X1F3DQBnJa2tzgBJ54bn4aNDjuWDtpygBsRqcfGRK4gbbw3xUy3oJv7TwpUG4 and 87q6aU1M9xmQ5p3wh8Jzst5mcFfDzKEuuDjV6u7Q7UDnAXJR7FLeQH2UYFzhQatde2WHuZ9LbxRsf3PGA8gpnGXL3G7iWMv. These two Monero wallets are just two of the three known Monero wallets that are associated with the [WatchDog cryptojacking group](https://unit42.paloaltonetworks.com/watchdog-cryptojacking/). Of note, the IP address listed within Figure 8, 139.99.102\[.\]72, resolves to the previously mentioned xmr-asia1.nanopool\[.\]org mining pool.
![The IP address listed within Figure 8, 139.99.102\[.\]72, resolves to the previously mentioned xmr-asia1.nanopool\[.\]org mining pool.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-29.png) Figure 8. WatchDog Monero wallet addresses.

## Linking WatchDog Infrastructure to TeamTNT

The URL addresses and Monero wallet address, 87A5fSCR98nFSR9NCRxt6UFytca3hJXaRdDgf9NxhWTjT3q3AA8HECyZ1FdF93D5LPXsSqS8dKNsxCxafrbuVeZfMW3V7ib, specifically called out within the sample 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce (see Figure 9), are known WatchDog indicators. However, the sample also includes the email address hilde@teamtnt\[.\]red, which is a known TeamTNT email address.
![The URL addresses, email address and Monero wallet specifically called out within the sample 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce are known TeamTNT indicators.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-30.png) Figure 9. Known WatchDog indicators of compromise (IoCs), as well as the TeamTNT email address.

Now to the malware sample, 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6, which contains the new WatchDog Monero wallet, as shown in Figure 10. The same MOxmrigMOD URL address as the known TeamTNT IoC shown within Figure 9 is present, but in this sample we also see additional URL addresses that have very strong ties to WatchDog infrastructure, specifically those involving the domain name oracle.zzhreceive\[.\]top.
![The malware sample, 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6, contains the new WatchDog Monero wallet.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-31.png) Figure 10. New IoCs analyzed in surrounding text.

With the presence of the C2 infrastructure from these new scripts, Figure 9 and Figure 10, both of which use the WatchDog directory, b2f628, there is a clear link to the TeamTNT infrastructure. The domain oracle.zzhreceive\[.\]top resolves to the IP address 199.19.226\[.\]117, which is also the resolution IP address for the known TeamTNT subdomain zzhrecieve.anondns\[.\]net.

The usage of the anondns\[.\]net domain has been linked to several TeamTNT campaigns across multiple reports including, [irc.anondns\[.\]net](https://blog.aquasec.com/fileless-malware-container-security), [ircbd.anondns\[.\]net](https://www.lacework.com/teamtnt-builds-botnet-from-chinese-cloud-servers/), [sampan.anondns\[.\]net](https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/) and [teamtntisback.anondns\[.\]net](https://www.cadosecurity.com/post/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials). Additionally, the 199.19.226\[.\]117 system has also been linked to WatchDog operations through the toolkit file 1.0.4.tar.gz, 51de345f677f46595fc3bd747bfb61bc9ff130adcbec48f3401f8057c8702af9, which was hosted on hxxp://global.bitmex\[.\]com\[.\]de/cf67355a3333e6/1.0.4.tar.gz and contains C code for the [masscan](https://github.com/robertdavidgraham/masscan) utility, which is the same toolkit used in the TeamTNT operations. The bitmex\[.\]com\[.\]de URL had previously been linked to the WatchDog cryptojacking group.

#### TeamTNT Malware Repository

The malware repository 85.214.149\[.\]236:443/sugarcrm/themes/default/images/ contains known TeamTNT malware that includes the same files as the known TeamTNT repository hxxp://dockerupdate.anondns\[.\]net:443/sugarcrm/themes/default/images/, which is linked to TeamTNT via the malware sample [1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b](https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html), as shown in Figure 11.

![The malware repository 85.214.149\[.\]236:443/sugarcrm/themes/default/images/ contains known TeamTNT malware that includes the same files as the known TeamTNT repository hxxp://dockerupdate.anondns\[.\]net:443/sugarcrm/themes/default/images/, which is linked to TeamTNT via the malware sample 1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-32.png) Figure 11. Known TeamTNT malware repository. Of note, some the of malware samples included in this repository were the Kubernetes and Docker-focused malware, 'kube.jpg' and 'tshd', presented in [Unit 42's Black-T blog](https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/), but these appear to no longer be used in the new scripts discussed within this blog. See the appendix for a full listing of the known TeamTNT malware metadata collected from the malware repository.

The malware sample 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 is of note in this context as it contains the hardcoded IP address, 199.19.226\[.\]117, as well as the hardcoded Monero wallet address associated with the nanopool and f2pool mining pools, and the mining workers previously discussed (Figures 12 and 13). As the previous section mentioned, the IP address 199.19.226\[.\]117 also resolves to the known TeamTNT domain zzhrecieve.anondns\[.\]net.

![The malware sample 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 is of note in this context as it contains the hardcoded IP address, ‘199.19.226\[.\]117’, as well as the hardcoded Monero wallet address associated with the nanopool and f2pool mining pools, and the mining workers previously discussed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-33.png) Figure 12. WatchDog directory using TeamTNT infrastructure. ![The malware sample 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 is of note in this context as it contains the hardcoded IP address, ‘199.19.226\[.\]117’, as well as the hardcoded Monero wallet address associated with the nanopool and f2pool mining pools, and the mining workers previously discussed.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-34.png) Figure 13. WatchDog Monero wallet address within TeamTNT infrastructure. Finally, another TeamTNT malware repository was identified by Unit 42 researchers, as shown in Figure 14. The larger [Chimaera repository](https://unit42.paloaltonetworks.com/teamtnt-operations-cloud-environments) contains known TeamTNT cryptojacking scripts and binary files. Within the spread/redis directory, the file b.sh, 3b14c84525f2e56fe3ae7dec09163a4a9c03f11e6a8d65b021c792ad13ed2701, was found, which directly links TeamTNT to the cryptojacking operations expressed in this report.

![Another TeamTNT malware repository was identified by Unit 42 researchers. The larger Chimaera repository contains known TeamTNT cryptojacking scripts and binary files. Within the spread/redis directory, the file b.sh, 3b14c84525f2e56fe3ae7dec09163a4a9c03f11e6a8d65b021c792ad13ed2701, was found, which directly links TeamTNT to the cryptojacking operations expressed in this report.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-35.png) Figure 14. TeamTnT repository containing the b.sh script.

The b.sh script contains the 43xb TeamTNT and WatchDog Monero wallet address and points to the 199.19.226\[.\]117 TeamTNT and WatchDog IP addresses (Figure 15). It also contains a hardcoded link to a known TeamTNT cloud enumeration script hosted on the known TeamTNT domain borg\[.\]wtf, see Figure 16.

![The b.sh script contains the 43xb TeamTNT and WatchDog Monero wallet address and points to the 199.19.226\[.\]117 TeamTNT and WatchDog IP addresses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-36.png) Figure 15. TeamTNT and WatchDog XMR wallet and IP address. ![It also contains a hardcoded link to a known TeamTNT cloud enumeration script hosted on the known TeamTNT domain borg\[.\]wtf.](https://unit42.paloaltonetworks.com/wp-content/uploads/2021/06/word-image-37.png) Figure 16. Known TeamTnT domain borg\[.\]wtf. The borg\[.\]wtf domain was linked to TeamTNT via a [previous Unit 42 report](https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/). The correlations between TeamTNT and WatchDog are intrinsically connected with this b.sh script.

## Conclusion

Considering the above evidence, it appears that WatchDog operations have incorporated the TTPs of the TeamTNT cryptojacking group and have significantly increased their own cryptojacking operations. The new WatchDog operation does not appear to use the advanced functionalities TeamTNT has used recently, namely cloud credential scraping as well as targeted Kubernetes- and Docker-focused lateral movement and exploit scripts.

It's also noteworthy that the new operation does not incorporate the more advanced GoLang binaries traditionally associated with WatchDog, which are capable of exploiting Windows- or NIX-based operating systems.

It appears that WatchDog actors are attempting to expand their cryptojacking operations, while simultaneously masking their operations with those of the known cryptojacking operations performed by TeamTNT. Unit 42 researchers will continue to monitor this cryptojacking event and provide updates as needed.

The following tips are highly recommended by Unit 42 researchers to assist in the protection of cloud infrastructure.

* Monitor and block network traffic to known malicious endpoints.
* Only deploy vetted container images within production environments.
* Implement and use Infrastructure as Code (IaC) scanning platforms to prevent insecure cloud instances from being deployed into production environments.
* Use cloud infrastructure configuration scanning tools that enable governance, risk management and compliance (GRC) to identify potentially threatening misconfigurations.
* Use cloud endpoint agents to monitor and prevent the running of known malicious applications within cloud infrastructure.

Palo Alto Networks [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) customers are protected from these threats through the Runtime Protection feature, Cryptominer Detection feature and the Prisma Cloud Compute Kubernetes Compliance Protection, which alerts on an insufficient Kubernetes configuration and provides secure alternatives. Additionally, Palo Alto Networks [VM-Series](https://www.paloaltonetworks.com/prisma/vm-series) and [CN-Series](https://www.paloaltonetworks.com/network-security/cn-series) products offer cloud protections that can prevent network connections from cloud instances toward known malicious IP addresses and URLs.

#### Indicators of Compromise

###### IP Addresses

103\.125.218\[.\]107  
47\.253.42\[.\]213  
176\.123.10\[.\]57  
39\.100.33\[.\]209  
45\.9.150\[.\]36  
106\.15.74\[.\]113  
45\.9.148\[.\]35  
13\.245.9\[.\]147  
85\.214.149\[.\]236  
45\.9.148\[.\]37  
199\.19.226\[.\]117

###### URL Addresses

85\.214.149\[.\]236:443/sugarcrm/themes/default/images/ hxxp://dockerupdate.anondns\[.\]net:443/sugarcrm/themes/default/images/

###### Domains

global.bitmex.com\[.\]de  
gsearch.com\[.\]de  
de.gsearch.com\[.\]de  
oracle.zzhreceive\[.\]top  
zzhreceive.anondns\[.\]net  
projectbluebeam.anondns\[.\]net

###### Monero (XMR) Wallets

43Xbgtym2GZWBk87XiYbCpTKGPBTxYZZWi44SWrkqqvzPZV6Pfmjv3UHR6FDwvPgePJyv9N5PepeajfmKp1X71EW7jx4Tpz

###### Monero (XMR) Mining Pools

xmr-asia1.nanopool\[.\]org:14444  
xmr.f2pool\[.\]com:13531  
Xmr.pool.gntl.co\[.\]uk:10009  
xmr.bohemianpool\[.\]com

###### Repository SHA256 Hashes

|------------------------------------------------------------------|-------------------------------------|
| **SHA256**                                                       | **FileName**                        |
| a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf | kube.jpg                            |
| e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3 | bioset.jpg                          |
| 252bf8c685289759b90c1de6f9db345c2cfe62e6f8aad9a7f44dfb3c8508487a | tshd.jpg                            |
| 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375 | default.jpg                         |
| 4f115381c17ba1dedb25d35d922feda9a723e206d811ed437b75fd8116ef461b | 21.jpg                              |
| 4a5d3435cd4a835056b4940e1cea9a25b1619562525bd9953a120b556b305983 | 22.jpg                              |
| feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06 | mod.jpg                             |
| 2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f | stock.jpg                           |
| 9791ab0a00caf9de8df9eab1d8998d1b48bcc7c724b7d833cb1793cadc577e5f | beta.jpg                            |
| 72b1cbfbd87c6cd85b9dc1da48c852768003e7fb4f01d8f6904921474be199ad | ms.jpg                              |
| b5f6d6114e1ce863675df1bf2e4bfaeac243e22bb399e64b9a96c6d975330b28 | mo2.jpg                             |
| 88585888c4dd2450cc885fc8b75b555ea6f924c78581d5eeae5b54b4b6951ac5 | b\_armv7l                            |
| ce5cd41711e74f11d8c01380194d9bb542da08733c81c317ec51089137330e0c | blue.tmp.jpg                        |
| 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce | mos.jpg                             |
| 1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b | nk.jpg                              |
| 3ef459b97522a8e39953befa2e8c0e970bbbb0f7f9d3e1ff22b0f7759de04be1 | b374k-master.zip                    |
| c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9 | mod.js                              |
| 230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769 | Carray.jpg                          |
| b556d266b154c303bb90db005d7dd4267ed8d0e711e3fd32406c64b1fc977f9e | local.jpg                           |
| 78037e2d2e596bd450b99551535fa9c38c4e8346ab75eb424bf9e95316424fbe | 01.jpg                              |
| f3b53ebc7cb45c57854059be00ccde4c05cb1d66c4c5c55a93072b76f07a9c38 | armv7l\_xmrig.jpg                    |
| ad1133cdcb486bab2368347b3ab35e83e5cd492c4bc6bfcb11a4b4c99d2c8014 | xmrig-6.3.3-linux-static-x64.tar.gz |
| bc02d0f9ec27f3c8d23c2f4647007e37a86fd404df0eef76c081fbb895f1be1b | ktu.jpg                             |
| 2a373d3e3e61999af09322b35356d26f95e183b1bb6222cae24d28b7b00ca01f | flink.jpg                           |
| bcfa215dec8fe15d4265c508c39c1ebafb7370acc95721e4e7d610b0459eb8dd | jq.jpg                              |
| b63efd9cca6a7379bc2a7e2b1ef721eedb0f3ac95afc14f2dd8db34f95688523 | logs                                |
| 79a060a0efcf4a1538c58e532b984dcd927fda17ca9fd10c2ff212f9d9d76be6 | det.jpg                             |
| b257a06a185f07e416f2b5ccc891fb799b82ce06bf1d4620d2439be65556c926 | sok.js                              |
| b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4 | ssh.jpg                             |

###### Hashes Used in This Investigation

|------------------------------------------------------------------|
| 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 |
| 05963eaca329830c80a7fa2e9bea3b4ec2fe277f882f68be29befedb80d5738d |
| 0910f78b68ccf1127a6a8f55d48b55c018149b4d5ab4a3fde56386a61c029ef4 |
| 10fb8d16f7d168340be28c6d0ba94e10c15370c8747d97bc0e5fad4b4466cf09 |
| 22174c47cb1aa38ee0f5030597671b2436f1394f8229dc9708863e2e567576e6 |
| 2bc6c21d35ed63b135b4723444a9ac532e4cb6aaa2bbd63c557136edb4e4756f |
| 30f0207b74d6d2d17cd8f4dc9f9131bd8763702f19c87ce74ea13a634f52c995 |
| 33da23085fb6fd7aad89e0c55b7ccbc2ee50fec4e8e31030e4b2a4ef034ac5f6 |
| 34b547b567309618422d7075322ddf5b9e0b3a4fb652f3845d12fd649f23923e |
| 36ca9f84864ad022c255b7d91e75997f035716e4df5dc1c90ee2651f092f5d79 |
| 3b14c84525f2e56fe3ae7dec09163a4a9c03f11e6a8d65b021c792ad13ed2701 |
| 3b280a4017ef2c2aef4b3ed8bb47516b816166998462899935afb39b533890ad |
| 3b53ed760142431ad45e550fd7a8d5c44ea4342619d9882909d8e3936283ec72 |
| 3d8a6f5d8162e8eb78e7b95384ec6418f65b904dffa8fd983a6a19a5645ad707 |
| 3e6cf5ae8ce6ff7305da4e218a20ec7f57933235ec07d7ff6e6a18c7c844ff29 |
| 428633aee75f7c69a7c0612e591d5fcecbcf13619d6c05b86c8303a248c7c8d7 |
| 466823948c92531a171a5ecb04339074cabd9d700ae67ea332f82cb3838490d2 |
| 49366ae4766492d94136ca1f715a37554aa6243686c66bf3c6fbb9da9cb2793d |
| 62957aa4421c044927269e9bf3300515cf01225fd4c3c3811f8ebfac7a9f8585 |
| 64072e7c56895f59124c4e26e0dd65a4de0bd8280c83372c18f9835978cda0e9 |
| 7848fc64c9977796dcc0ee67c293f006d715d3b3e257a3c0f4654cefab637c45 |
| 7a8c91f4228be4d36e1087acc9bb046373ddfde506fe4645ad1b0967c08bfa8b |
| 7b6f7c48256a8df2041e8726c3490ccb6987e1a76fee947e148ea68eee036889 |
| 8adc8be4b7fa2f536f4479fa770bf4024b26b6838f5e798c702e4a7a9c1a48c6 |
| 8d9bdcae4a4559e52b3d03209a1ef880e948d9f3969f7779119d9322c5f7cf7c |
| ab73aedbee66081cd047b19a4bb036f85791a9ae9abc90545c5d8756bbc2a428 |
| ae3e4a1c8a2b661265e6c8c756e3ba472dc7177cae79fe1861ab0c2d1af5167a |
| ae6822d1fd097e8c52cea3731cd49f50600b7da83e9f0ea6dbc689685f907739 |
| af611a41c55e9afcfaced8b067a470caa70825fce0a44167f44a8d3880ae6674 |
| c141eaeab461a2481124a73ee2d254301573d8722dbf3221f5fc54d7770e67a2 |
| c850fa9c2cdcf77dc0e7732785473db8881efe49935ddb7c6da9f3d1911a469f |
| cbf54a9e5771fcb3760e4e282f003a879164e76b9df9fed0fe4e4e8aaaef11ae |
| cf890e288f4fb7a2cfb0aa7e91229cc51c224e767c6ca69bbbb9d06e999ede64 |
| e1d7014b84618cd7fbf94439c78fe7d67f351cbc5536885fa3d94ea15325d83b |
| e47802d7f44fc9e594b89ef33298367d21695d5ec1ae5e6c526b9f3124c555ca |
| eca42c42f0909cf4e6df6bf8de35ab93ef6a3dd10d0d5e556721ec1871a9990c |
| f235c021baa6c8801e724d45003b1b1541eea5483810abc9c3eb4df6bf05afbf |

Back to top

### Tags

* [Cryptojacking](https://unit42.paloaltonetworks.com/tag/cryptojacking/ "cryptojacking")
* [Monero](https://unit42.paloaltonetworks.com/tag/monero/ "Monero")
* [TeamTnT](https://unit42.paloaltonetworks.com/tag/teamtnt/ "TeamTnT")
* [WatchDog](https://unit42.paloaltonetworks.com/tag/watchdog/ "WatchDog")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Network Scanning Traffic Observed in Public Clouds](https://unit42.paloaltonetworks.com/cloud-network-scanning-traffic/ "Network Scanning Traffic Observed in Public Clouds")

### Table of Contents

* 

### Related Articles

* [Resurgence of the Prometei Botnet](https://unit42.paloaltonetworks.com/prometei-botnet-2025-activity/ "article - table of contents")
* [CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys](https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/ "article - table of contents")
* [Why LaZagne Makes D-Bus API Vigilance Crucial](https://unit42.paloaltonetworks.com/lazagne-leverages-d-bus/ "article - table of contents")

## Related Resources

![Pictorial representation of automated detection. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Cloud_cybersecurity_research_Overview_1920x900-2-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 14, 2026 [#### Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection](https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/)

* [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail")

* [Cloud detection](https://unit42.paloaltonetworks.com/tag/cloud-detection/ "cloud detection")

* [DevOps](https://unit42.paloaltonetworks.com/tag/devops/ "DevOps")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/ "Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection")  
  ![Pictorial representation of Russian global webmail espionage campaign. A digital illustration of a world map in a network style, highlighting continents with glowing lines and connectivity points in a red and blue theme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/07/06_Nation-State-cyberattacks_1920x900-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) July 23, 2026 [#### Russian Global Webmail Espionage](https://unit42.paloaltonetworks.com/russian-webmail-espionage/)

* [CL-STA-1114](https://unit42.paloaltonetworks.com/tag/cl-sta-1114/ "CL-STA-1114")

* [JavaScript](https://unit42.paloaltonetworks.com/tag/javascript/ "JavaScript")

* [Javascript injection](https://unit42.paloaltonetworks.com/tag/javascript-injection/ "javascript injection")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/russian-webmail-espionage/ "Russian Global Webmail Espionage")  
  ![Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 22, 2026 [#### The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/)

* [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS")

* [Bucket hijacking](https://unit42.paloaltonetworks.com/tag/bucket-hijacking/ "bucket hijacking")

* [Cloud data exfiltration](https://unit42.paloaltonetworks.com/tag/cloud-data-exfiltration/ "cloud data exfiltration")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration")  
  ![Pictorial representation of Vertex AI model uploads. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-786x354.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 16, 2026 [#### Pickle in the Middle -- Hijacking Vertex AI Model Uploads for Cross-Tenant RCE](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/)

* [Bucket squatting](https://unit42.paloaltonetworks.com/tag/bucket-squatting/ "bucket squatting")

* [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud")

* [Joblib](https://unit42.paloaltonetworks.com/tag/joblib/ "joblib")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ "Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE")  
  ![Pictorial representation of Cloud Logging services for defense evasion. A vibrant digital illustration depicting a glowing, neon blue cloud symbol positioned over a circuit board landscape. The cloud symbolizes cloud computing technology, and the landscape features intricate electronic circuits with glowing lines and nodes, suggesting high-tech data transfer and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 9, 2026 [#### Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/)

* [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail")

* [Cloud logging](https://unit42.paloaltonetworks.com/tag/cloud-logging/ "cloud logging")

* [Defense evasion](https://unit42.paloaltonetworks.com/tag/defense-evasion/ "defense evasion")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ "Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility")  
  ![Pictorial representation of a woman standing in a server room holding a laptop that projects a digital code overlay.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/06_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 28, 2026 [#### 2026 World Cup: Discussing The World's Biggest Game's Attack Surface](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/)

* [Fiddling Scorpius](https://unit42.paloaltonetworks.com/tag/fiddling-scorpius/ "Fiddling Scorpius")

* [Fighting Ursa](https://unit42.paloaltonetworks.com/tag/fighting-ursa/ "Fighting Ursa")

* [Muddled Libra](https://unit42.paloaltonetworks.com/tag/muddled-libra/ "Muddled Libra")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/fifa-world-cup-attack-surface/ "2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface")  
  ![Pictoral representation of a man holding a cellphone with a bokeh skyline in the background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/05_Listicle_Category_1505x922-718x440.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) May 27, 2026 [#### Out of the Crypt: The Evolving Cyber Extortion Economy](https://unit42.paloaltonetworks.com/cyber-extortion-economy/)

* [Bling Libra](https://unit42.paloaltonetworks.com/tag/bling-libra/ "Bling Libra")

* [Extortion](https://unit42.paloaltonetworks.com/tag/extortion/ "Extortion")

* [Frontier AI](https://unit42.paloaltonetworks.com/tag/frontier-ai/ "Frontier AI")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cyber-extortion-economy/ "Out of the Crypt: The Evolving Cyber Extortion Economy")  
  ![Pictorial representation of ROADtools framework in the cloud. An Asian man wearing glasses sits in front of a computer screen. Reflecting in the glasses are lines indicating analysis. Bright blue city lights illuminate the rest of the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 22, 2026 [#### Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/)

* [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "Paved With Intent: ROADtools and Nation-State Tactics in the Cloud")  
  ![Pictorial representation of autonomous AI attack in cloud environments. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 23, 2026 [#### Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/)

* [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI")

* [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud")

* [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System")  
  ![Pictorial representation of passwordless authentication. Futuristic cityscape with skyscrapers surrounded by glowing, neon-lit pathways and digital clouds. The sky is vibrant with pink and orange hues, giving a surreal, cyberpunk aesthetic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/02_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 23, 2026 [#### Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication/)

* [Google](https://unit42.paloaltonetworks.com/tag/google/ "Google")

* [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator")

* [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication/ "Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)