H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Hildegard](https://attack.mitre.org/software/S0601) is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind [Hildegard](https://attack.mitre.org/software/S0601). (Citation: Unit 42 Hildegard Malware)

Labels

malware

28 recorded

Relationships

uses

to Application Layer Protocol

Technique

uses

to Clear Command History

Technique

uses

to Cloud Instance Metadata API

Technique

uses

to Compute Hijacking

Technique

uses

to Container Administration Command

Technique

uses

to Container and Resource Discovery

Technique

uses

to Credentials In Files

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Dynamic Linker Hijacking

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Escape to Host

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to External Remote Services

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Masquerade Task or Service

Technique

uses

to Network Service Discovery

Technique

uses

to Private Keys

Technique

uses

to Remote Access Tools

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to Systemd Service

Technique

uses

to System Information Discovery

Technique

uses

Technique

uses

Technique

uses

Group

2 external

References

mitre-attack

S0601

Unit 42 Hildegard Malware

https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/