ATT&CK ReferencesUnit 42 Hildegard Malware

Unit 42 Hildegard Malware

Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

Open the source

Techniques3

Groups1

TeamTNT

Software1

Hildegard

Campaigns0

None recorded.

Procedure examples32

Technique	Used by	Procedure example
T1014 Rootkit	MalwareHildegard	Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64(). Unit 42 Hildegard Malware
T1027.002 Software Packing	MalwareHildegard	Hildegard has packed ELF files into other binaries. Unit 42 Hildegard Malware
T1027.013 Encrypted/Encoded File	MalwareHildegard	Hildegard has encrypted an ELF file. Unit 42 Hildegard Malware
T1036.004 Masquerade Task or Service	MalwareHildegard	Hildegard has disguised itself as a known Linux process. Unit 42 Hildegard Malware
T1046 Network Service Discovery	MalwareHildegard	Hildegard has used masscan to look for kubelets in the internal Kubernetes network. Unit 42 Hildegard Malware
T1046 Network Service Discovery	GroupTeamTNT	TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments. Cado Security TeamTNT Worm August 2020 Cisco Talos Intelligence Group Palo Alto Black-T October 2020 Unit 42 Hildegard Malware
T1059.004 Unix Shell	MalwareHildegard	Hildegard has used shell scripts for execution. Unit 42 Hildegard Malware
T1068 Exploitation for Privilege Escalation	MalwareHildegard	Hildegard has used the BOtB tool which exploits CVE-2019-5736. Unit 42 Hildegard Malware
T1070.003 Clear Command History	MalwareHildegard	Hildegard has used history -c to clear script shell logs. Unit 42 Hildegard Malware
T1070.004 File Deletion	MalwareHildegard	Hildegard has deleted scripts after execution. Unit 42 Hildegard Malware
T1071 Application Layer Protocol	MalwareHildegard	Hildegard has used an IRC channel for C2 communications. Unit 42 Hildegard Malware
T1082 System Information Discovery	MalwareHildegard	Hildegard has collected the host's OS, CPU, and memory information. Unit 42 Hildegard Malware
T1102 Web Service	MalwareHildegard	Hildegard has downloaded scripts from GitHub. Unit 42 Hildegard Malware
T1105 Ingress Tool Transfer	MalwareHildegard	Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners. Unit 42 Hildegard Malware
T1133 External Remote Services	GroupTeamTNT	TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments. Cisco Talos Intelligence Group Intezer TeamTNT September 2020 Unit 42 Hildegard Malware
T1133 External Remote Services	MalwareHildegard	Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment. Unit 42 Hildegard Malware
T1136.001 Local Account	MalwareHildegard	Hildegard has created a user named “monerodaemon”. Unit 42 Hildegard Malware
T1140 Deobfuscate/Decode Files or Information	MalwareHildegard	Hildegard has decrypted ELF files with AES. Unit 42 Hildegard Malware
T1219 Remote Access Tools	GroupTeamTNT	TeamTNT has established tmate sessions for C2 communications. Cisco Talos Intelligence Group Unit 42 Hildegard Malware
T1219 Remote Access Tools	MalwareHildegard	Hildegard has established tmate sessions for C2 communications. Unit 42 Hildegard Malware
T1496.001 Compute Hijacking	MalwareHildegard	Hildegard has used xmrig to mine cryptocurrency. Unit 42 Hildegard Malware
T1543.002 Systemd Service	MalwareHildegard	Hildegard has started a monero service. Unit 42 Hildegard Malware
T1552.001 Credentials In Files	MalwareHildegard	Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens. Unit 42 Hildegard Malware
T1552.004 Private Keys	MalwareHildegard	Hildegard has searched for private keys in .ssh. Unit 42 Hildegard Malware
T1552.005 Cloud Instance Metadata API	MalwareHildegard	Hildegard has queried the Cloud Instance Metadata API for cloud credentials. Unit 42 Hildegard Malware
T1574.006 Dynamic Linker Hijacking	MalwareHildegard	Hildegard has modified /etc/ld.so.preload to intercept shared library import functions. Unit 42 Hildegard Malware
T1587.001 Malware	GroupTeamTNT	TeamTNT has developed custom malware such as Hildegard. Unit 42 Hildegard Malware
T1609 Container Administration Command	GroupTeamTNT	TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers. Unit 42 Hildegard Malware
T1609 Container Administration Command	MalwareHildegard	Hildegard was executed through the kubelet API run command and by executing commands on running containers. Unit 42 Hildegard Malware
T1611 Escape to Host	MalwareHildegard	Hildegard has used the BOtB tool that can break out of containers. Unit 42 Hildegard Malware
T1613 Container and Resource Discovery	MalwareHildegard	Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers. Unit 42 Hildegard Malware
T1685 Disable or Modify Tools	MalwareHildegard	Hildegard has modified DNS resolvers to evade DNS monitoring tools. Unit 42 Hildegard Malware

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.