ATT&CKSoftwareHildegard

Hildegard

S0601

Malware.View on attack.mitre.org

About this malware

Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard.

Techniques used27

Initial Access1

T1133External Remote Services

Execution3

T1059.004Unix ShellT1574.006Dynamic Linker HijackingT1609Container Administration Command

Persistence3

T1133External Remote ServicesT1136.001Local AccountT1543.002Systemd Service

Privilege Escalation3

T1068Exploitation for Privilege EscalationT1543.002Systemd ServiceT1611Escape to Host

Stealth8

T1014RootkitT1027.002Software PackingT1027.013Encrypted/Encoded FileT1036.004Masquerade Task or ServiceT1070.003Clear Command HistoryT1070.004File DeletionT1140Deobfuscate/Decode Files or InformationT1574.006Dynamic Linker Hijacking

Defense Impairment1

T1685Disable or Modify Tools

Credential Access3

T1552.001Credentials In FilesT1552.004Private KeysT1552.005Cloud Instance Metadata API

Discovery3

T1046Network Service DiscoveryT1082System Information DiscoveryT1613Container and Resource Discovery

Command and Control4

T1071Application Layer ProtocolT1102Web ServiceT1105Ingress Tool TransferT1219Remote Access Tools

Impact1

T1496.001Compute Hijacking

Procedure examples27

TechniqueProcedure example
T1014
Rootkit

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().

Unit 42 Hildegard Malware
T1027.002
Software Packing

Hildegard has packed ELF files into other binaries.

Unit 42 Hildegard Malware
T1027.013
Encrypted/Encoded File

Hildegard has encrypted an ELF file.

Unit 42 Hildegard Malware
T1036.004
Masquerade Task or Service

Hildegard has disguised itself as a known Linux process.

Unit 42 Hildegard Malware
T1046
Network Service Discovery

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.

Unit 42 Hildegard Malware
T1059.004
Unix Shell

Hildegard has used shell scripts for execution.

Unit 42 Hildegard Malware
T1068
Exploitation for Privilege Escalation

Hildegard has used the BOtB tool which exploits CVE-2019-5736.

Unit 42 Hildegard Malware
T1070.003
Clear Command History

Hildegard has used history -c to clear script shell logs.

Unit 42 Hildegard Malware
T1070.004
File Deletion

Hildegard has deleted scripts after execution.

Unit 42 Hildegard Malware
T1071
Application Layer Protocol

Hildegard has used an IRC channel for C2 communications.

Unit 42 Hildegard Malware
T1082
System Information Discovery

Hildegard has collected the host's OS, CPU, and memory information.

Unit 42 Hildegard Malware
T1102
Web Service

Hildegard has downloaded scripts from GitHub.

Unit 42 Hildegard Malware
T1105
Ingress Tool Transfer

Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.

Unit 42 Hildegard Malware
T1133
External Remote Services

Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.

Unit 42 Hildegard Malware
T1136.001
Local Account

Hildegard has created a user named “monerodaemon”.

Unit 42 Hildegard Malware

View all 27 procedure examples

Groups that use it1

TeamTNT

Campaigns0

None recorded.

References1

  1. Unit 42 Hildegard Malware Open source
    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn