ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0601malware

Hildegard

Hildegard is malware that targets misconfigured kubelets for initial access and runs cryptocurrency miner operations. The malware was first observed in January 2021. The TeamTNT activity group is believed to be behind Hildegard.

Platforms: Linux, Containers, IaaS

MITRE ATT&CK ↗

Linked entities · 24

usesT1071Application Layer Protocol usesT1552.004Private Keys usesT1070.004File Deletion usesT1609Container Administration Command usesT1613Container and Resource Discovery usesT1574.006Dynamic Linker Hijacking usesT1046Network Service Discovery usesT1133External Remote Services usesT1552.001Credentials In Files usesT1027.002Software Packing usesT1036.004Masquerade Task or Service usesT1082System Information Discovery usesT1102Web Service usesT1685Disable or Modify Tools usesT1014Rootkit usesT1070.003Clear Command History usesT1219Remote Access Tools usesT1140Deobfuscate/Decode Files or Infor…usesT1496.001Compute Hijacking usesT1136.001Local Account usesT1105Ingress Tool Transfer usesT1552.005Cloud Instance Metadata API usesT1027.013Encrypted/Encoded File usesT1543.002Systemd Service