Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes

Summary: In January 2021, Unit 42 researchers detected a new TeamTNT campaign, named Hildegard after the tmate account username the malware used, that gained initial access to Kubernetes clusters through kubelets allowing anonymous access and spread across containers to run cryptojacking operations. The malware used tmate reverse shells and an IRC agent built from ziggystartux, hid its tmate, xmrig and ziggy processes via LD_PRELOAD and /etc/ld.so.preload, and dropped Peirates and BOtB for container breakout and credential theft.

What you should know: The campaign held roughly 25.05 KH/s of hashing power and 11 XMR (about $1,500) in its wallet, with around 220 clients connected to an IRC server that went online on Jan. 9, 2021 - and Unit 42 assesses the codebase and infrastructure are still incomplete, so a larger attack is expected.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related