Black-T Malware, a new cryptojacking variant from TeamTnT, favors targeting AWS credential files. TeamTnT is a cloud-focused cryptojacking group that often targets AWS credential files on compromised cloud systems to mine for Monero. By September, TeamTnT was able to gain full remote takeover of cloud instances. The researchers found that Black-T includes features not found in the group’s earlier malware, including “targeting and stopping of previously unknown cryptojacking worms – the Crux worm, ntpd miner and a redis-backup miner,”.
Black-T also features memory password scraping using mimipy and mimipenguins, which are *NIX equivalents to the commonly used Windows-specific memory password scraper functionality of Mimikatz. Mimikatz is a tool capable of scraping plaintext passwords from Windows OS systems, and also has the capability to perform pass-the-hash and pass-the-token operations, allowing attackers to hijack user sessions. Any identified passwords which were obtained through mimipenguins are then exfiltrated to a TeamTnT command and control (C2) node. This is the first time TeamTnT actors have been witnessed including this type of post-exploitation operation in their TTPs. The Black-T tool also has the capability to use three different network scanning tools to identify additional exposed Docker daemon APIs, within the local network of the compromised system and across any number of publicly accessible networks, to extend their cryptojacking operations.