Indicators captured from a TrendMicro honeypot shows activity relating back to the TeamTNT threat organization, which was reportedly out of commission in November 2021. Historically, TeamTNT was a threat group that primarily targeted cloud and container environments on a global scale. These actors would often deploy cryptocurrency miners onto the victim’s environment for their own personal usage. After about a three (3) year run, TeamTNT stated that it was ceasing operations in 2021. Recent attack patterns captured by security teams shows indications of a possible return from TeamTNT, citing known malicious IP addresses establishing connections to exposed Docker API endpoints. While this shows a plausible return from TeamTNT, security analysts remain optimistic as there is a possibility of one or more copycat organizations using previously allocated TeamTNT infrastructure to carry out similar cryptocurrency attacks. The supposed returning group has been seen deploying the XMRig cryptominer malware on compromised systems alongside ZGrab, pnscan, and massscan scripts. Some domains and filenames link back to known WatchDog indicators of compromise from previous attacks. CTIX analysts will continue to monitor activity surrounding a potential TeamTNT return and provide additional updates accordingly.