Black-T: New Cryptojacking Variant from TeamTNT
Summary: Unit 42 researchers found a new TeamTNT cryptojacking variant called Black-T that targets exposed Docker daemon APIs, removes competing miners such as Kinsing and the Crux worm, and mines Monero. The tool adds mimipy and mimipenguins memory password scraping that exfiltrates credentials to a TeamTNT command-and-control node, plus three network scanners including the GoLang tool zgrab, and it still targets AWS credential files.
What you should know: Black-T scrapes plaintext passwords from memory and sends them to TeamTNT's C2, so a single exposed Docker daemon can hand over the AWS credentials that let attackers pivot into the rest of your cloud environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026