TeamTNT__2021__Hildegard_New_TeamTNT_Malware_Targeting_Kubernetes.pdf

Unit 42 reports on Hildegard, a TeamTNT malware campaign targeting Kubernetes clusters by abusing misconfigured kubelets to deploy and run miners across multiple containers, establish C2 via tmate or IRC, and evade detection with techniques like LD_PRELOAD and encrypted binaries; the campaign shows significant capabilities and IOCs but was observed in early development with potential to scale.