LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0601: Hildegard

Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard. [1]

EnterpriseS0601MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Hildegard matters because it ties Kubernetes misconfiguration to cloud and container business risk: unauthorized access to kubelets can lead to cryptocurrency mining, resource theft, persistence, credential exposure, and degraded service availability. For leaders, the practical question is not whether a malware name is present, but whether Kubernetes nodes, Linux hosts, and IaaS workloads are hardened and monitored well enough to catch miner behavior, suspicious shell activity, credential access, and persistence changes.

Executive priority

Prioritize this as a cloud/container resilience and cost-control issue. The supplied ATT&CK context links Hildegard to misconfigured kubelets, cryptocurrency mining, compute hijacking, credential access, persistence, and stealth techniques. Executives should ask for evidence that kubelet exposure is controlled, cloud metadata access is protected, container and Linux telemetry is retained, and incident responders can quickly determine whether resource abuse also created credentials, accounts, services, or follow-on access.

Technical view

ATT&CK provides no official detection text for Hildegard, so SOC and IR teams should validate behavior-based coverage across Linux, Containers, and IaaS. Focus on the related techniques: Unix shell execution, ingress tool transfer, network service discovery, application-layer or web-service C2, local account creation, systemd service creation/modification, credential and private-key discovery, cloud instance metadata API access, file deletion, command-history clearing, dynamic linker hijacking, rootkit behavior, and compute hijacking. Because the object specifically references misconfigured kubelets, Kubernetes/kubelet exposure and authentication/authorization posture should be part of both detection validation and hardening review.

Likely telemetry

  • Kubernetes and kubelet access logs, audit events, and configuration evidence showing authentication, authorization, and network exposure
  • Linux process execution telemetry for shells, downloads, service changes, account creation, file deletion, history manipulation, and dynamic linker environment usage
  • Container runtime and node telemetry showing unexpected processes, images, mounts, privilege use, and workload-to-node activity
  • IaaS network flow, DNS, proxy, and egress logs for application-layer communications, web-service usage, scanning, and tool transfer
  • Cloud instance metadata access logs or compensating host/network evidence where direct metadata logging is unavailable

Detection direction

  • Build detections around the ATT&CK behaviors rather than the malware name, because no official Hildegard detection guidance is supplied.
  • Correlate kubelet access anomalies with Linux shell execution, downloads, new or modified systemd services, new local accounts, and miner-like resource consumption.
  • Tune for container and cloud context: service discovery and metadata API access may be legitimate for some workloads, so detections should account for expected namespaces, nodes, roles, and workload identities.
  • Look for stealth chains, not single events: software packing or encoded files followed by deobfuscation, file deletion, command-history clearing, masqueraded services, dynamic linker hijacking, or rootkit indicators should raise priority.
  • Validate blind spots in ephemeral containers and autoscaled IaaS nodes, where short-lived activity, missing host logs, or incomplete container runtime telemetry can hide the sequence.

Mitigation priorities

  • First reduce initial access risk by reviewing kubelet configuration, external exposure, and authentication/authorization controls for Kubernetes environments.
  • Harden Linux and container hosts by limiting unnecessary remote services, enforcing least privilege, and controlling who can create services, accounts, privileged containers, and host mounts.
  • Protect cloud credentials by reducing insecure secrets in files, restricting access to private keys, and hardening access to the cloud instance metadata API where applicable.
  • Limit and monitor outbound network paths needed for tool transfer and command-and-control, especially from container nodes and workloads that should not initiate broad external connections.
  • Implement resource and workload controls that make compute hijacking visible and containable, including monitoring for abnormal CPU use and enforcing workload boundaries.
Additional notes and limits

The supplied object identifies Hildegard as malware targeting misconfigured kubelets for initial access and cryptocurrency mining, first observed in January 2021, with TeamTNT believed to be behind it. The relationship set is useful for defensive planning because it spans access, execution, persistence, credential access, command-and-control, stealth, discovery, privilege escalation, and compute hijacking behaviors across Linux, Containers, and IaaS.

ATT&CK does not provide official detection content for this malware object, and the malware object itself lists no tactics. This take is derived from the official description, external references, platforms, and supplied relationships only. Local architecture, kubelet exposure, logging depth, cloud provider controls, and workload baselines are required to assess actual risk or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Hildegard

Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

27 rows
DomainIDNameRelationship / procedure
EnterpriseT1071Application Layer Protocol

Hildegard has used an IRC channel for C2 communications.[1]

EnterpriseT1552.004Private KeysSub-technique

Hildegard has searched for private keys in .ssh.[1]

EnterpriseT1070.004File DeletionSub-technique

Hildegard has deleted scripts after execution.[1]

EnterpriseT1609Container Administration Command

Hildegard was executed through the kubelet API run command and by executing commands on running containers.[1]

EnterpriseT1613Container and Resource Discovery

Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.[1]

EnterpriseT1574.006Dynamic Linker HijackingSub-technique

Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.[1]

EnterpriseT1046Network Service Discovery

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.[1]

EnterpriseT1133External Remote Services

Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.[1]

EnterpriseT1552.001Credentials In FilesSub-technique

Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.[1]

EnterpriseT1027.002Software PackingSub-technique

Hildegard has packed ELF files into other binaries.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

Hildegard has disguised itself as a known Linux process.[1]

EnterpriseT1082System Information Discovery

Hildegard has collected the host's OS, CPU, and memory information.[1]

EnterpriseT1102Web Service

Hildegard has downloaded scripts from GitHub.[1]

EnterpriseT1685Disable or Modify Tools

Hildegard has modified DNS resolvers to evade DNS monitoring tools.[1]

EnterpriseT1014Rootkit

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().[1]

EnterpriseT1070.003Clear Command HistorySub-technique

Hildegard has used history -c to clear script shell logs.[1]

EnterpriseT1219Remote Access Tools

Hildegard has established tmate sessions for C2 communications.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Hildegard has decrypted ELF files with AES.[1]

EnterpriseT1496.001Compute HijackingSub-technique

Hildegard has used xmrig to mine cryptocurrency.[1]

EnterpriseT1136.001Local AccountSub-technique

Hildegard has created a user named “monerodaemon”.[1]

EnterpriseT1105Ingress Tool Transfer

Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.[1]

EnterpriseT1552.005Cloud Instance Metadata APISub-technique

Hildegard has queried the Cloud Instance Metadata API for cloud credentials.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Hildegard has encrypted an ELF file.[1]

EnterpriseT1543.002Systemd ServiceSub-technique

Hildegard has started a monero service.[1]

EnterpriseT1611Escape to Host

Hildegard has used the BOtB tool that can break out of containers. [1]

EnterpriseT1068Exploitation for Privilege Escalation

Hildegard has used the BOtB tool which exploits CVE-2019-5736.[1]

EnterpriseT1059.004Unix ShellSub-technique

Hildegard has used shell scripts for execution.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0139: TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071: Application Layer ProtocolEnterpriseuses · TechniqueT1552.004: Private KeysEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1609: Container Administration CommandEnterpriseuses · TechniqueT1613: Container and Resource DiscoveryEnterpriseuses · TechniqueT1574.006: Dynamic Linker HijackingEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1133: External Remote ServicesEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1014: RootkitEnterpriseuses · TechniqueT1070.003: Clear Command HistoryEnterpriseuses · TechniqueT1219: Remote Access ToolsEnterpriseuses · GroupG0139: TeamTNTEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1496.001: Compute HijackingEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1552.005: Cloud Instance Metadata APIEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
b1323b6bd6d00963...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundleb1323b6bd6d0…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  2. [2]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  3. [3]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  4. [4]
    mitre-attackS0601
    Open source URL
  5. [5]
    mitre-attackS0601
    Open source URL
  6. [6]
    mitre-attackS0601
    Open source URL
  7. [7]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  8. [8]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  9. [9]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  10. [10]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  11. [11]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  12. [12]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  13. [13]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  14. [14]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  15. [15]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  16. [16]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  17. [17]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  18. [18]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  19. [19]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  20. [20]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  21. [21]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  22. [22]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  23. [23]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  24. [24]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  25. [25]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  26. [26]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  27. [27]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  28. [28]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  29. [29]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  30. [30]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  31. [31]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  32. [32]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  33. [33]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  34. [34]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  35. [35]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  36. [36]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  37. [37]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  38. [38]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  39. [39]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  40. [40]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  41. [41]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  42. [42]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  43. [43]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  44. [44]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  45. [45]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  46. [46]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  47. [47]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  48. [48]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  49. [49]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  50. [50]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  51. [51]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  52. [52]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  53. [53]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  54. [54]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  55. [55]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  56. [56]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
  57. [57]
    Unit 42 Hildegard Malware

    Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use