Executive Summary
Hildegard exploits misconfigured kubelets to deliver a cryptocurrency miner to Linux and containerised hosts. Originated by TeamTNT in early 2021, the malware burdens clusters with illicit hashing while hiding within legitimate orchestrator traffic. Prompt detection of abnormal resource consumption and strict kubelet hardening are essential countermeasures.
Enhanced Description
Hildegard is a malware family first identified in January 2021 and attributed to the TeamTNT threat group. The malicious code targets Linux-based environments that run Kubernetes or related container orchestrators, specifically seeking incorrectly configured kubelet instances. Kubelets exposed through insecure settings – such as open APIs, mismanaged authentication tokens, or improperly defined RBAC policies – provide a privileged entry point that Hildegard exploits to deploy itself on the underlying host. Once it has gained foothold, Hildegard launches cryptocurrency mining binaries within the compromised container or directly on the host. In addition to leveraging system resources for illicit hashing, the malware may also establish persistence through kubelet restarts or by persisting configuration changes that enable automated redeployment of malicious containers whenever the cluster is refreshed. Monitoring for anomalous CPU utilisation spikes and unexpected mining processes should be considered a key indicator. The impact of Hildegard extends beyond financial loss from mined revenues. The strain on compute resources degrades cluster performance, potentially leading to service interruptions or forced teardown of workloads. In environments where multiple tenants share an infrastructure, the attacker could extend its reach by moving laterally into other namespaces or host nodes, thereby contaminating the entire Kubernetes ecosystem.
Key Capabilities
ATT&CK Techniques
Recommended Actions
Suggested Tags
Confidence Assessment
The available data offers a clear outline of Hildegard’s surface capabilities—targeting misconfigured kubelets and running cryptocurrency miners. However, detailed technical telemetry such as command‑line arguments, persistence mechanisms beyond kubelet restarts, or post‑infection exfiltration behaviour remains undocumented. Consequently, confidence in the completeness of this threat profile is moderate; additional analysis of sandboxed samples would bridge remaining gaps.
Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard. (Citation: Unit 42 Hildegard Malware)