⚠️ Overview

Hildegard is a Linux-based malware family first identified in August 2021 by Lacework Labs, targeting Kubernetes clusters with the goal of cryptomining. It is classified as a botnet and cryptominer, attributed to the TeamTNT threat group, which is known for cloud-focused attacks.

🔧 Technical Capabilities

Hildegard propagates by scanning for exposed kubeconfig files (typically .kube/config) and misconfigured Kubernetes API servers, then deploys a custom Golang backdoor that establishes persistent access via cron jobs and modified system binaries. It uses the Tor network for command-and-control (C2) communication to evade detection, leveraging the libtor library for anonymized traffic. The malware also exploits a known vulnerability in the Weave Scope tool (CVE-2020-11077) to gain initial footholds in unsecured installations. Persistence is achieved through systemd services and kernel modules, while evasion includes disabling security tools like SELinux and AppArmor.

📜 History & Notable Incidents

Hildegard was first publicly documented by Lacework Labs on August 10, 2021, following a series of cryptomining campaigns targeting exposed Kubernetes clusters. The malware shares code and infrastructure with TeamTNT’s earlier Linux malware, such as Minerbob and Palo Alto Networks-attributed tools. No high-profile victims were named, but the campaign affected hundreds of unsecured clusters globally, primarily in the technology and cloud service sectors.

🔍 Detection Indicators

Network indicators include outbound connections to Tor exit nodes on port 9001 and to specific hardcoded .onion addresses. File-system IOCs include scripts named kswapd (mimicking a legitimate kernel process) and a shared object libuboot.so used for Tor integration. No specific file hashes are publicly documented, but Sysmon and auditd logs can detect anomalous cron job creations and unexpected Tor traffic. Behavioral signatures include unusual CPU usage spikes from the cryptominer xmrig, and the presence of base64-encoded configuration files in /tmp.

☠️ Risk & Impact

The primary risk is resource hijacking for cryptomining, causing degraded performance and elevated cloud costs for affected organizations. While no data exfiltration has been confirmed, the backdoor capability could enable further malicious activities. The impact is most severe for cloud-native enterprises running Kubernetes in production environments, particularly in the technology and financial services sectors.

🛡️ Mitigation

Mitigation includes securing Kubernetes API servers with authentication and network policies, disabling anonymous access, and applying the patch for CVE-2020-11077. Defenders should deploy endpoint detection rules for Tor traffic and cryptominer signatures, and regularly audit kubeconfig files for unauthorized modifications. Lacework’s report recommends using runtime security tools to monitor for suspicious systemd service creation and kernel module loading.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.