Full Report
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
Analysis Summary
# Tool/Technique: Terraform Provider & Go Module Supply Chain Attack (Graphalgo Variant)
## Overview
This attack involves the distribution of Go-based malware through malicious entries in the HashiCorp Terraform Registry and Go module repositories. It marks the first documented instance of threat actors leveraging the centralized Terraform ecosystem as a distribution vector. The campaign uses "typosquatting" or impersonation of popular providers to deliver a sophisticated Remote Access Trojan (RAT) designed for intelligence gathering and further payload delivery.
## Technical Details
- **Type:** Malware Family / Supply Chain Attack
- **Platform:** Cross-platform (Go-based), specifically targeting DevOps/Cloud Engineering environments (Linux, macOS, Windows)
- **Capabilities:** System reconnaissance, dual-channel C2 (Slack & Blockchain), asymmetric encrypted communications, and modular payload execution.
- **First Seen:** February 2026 (Graphalgo campaign); Terraform specific discovery in September 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.002 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1102.001 - Web Service: Dead Drop Resolver]
- [T1102.002 - Web Service: Bidirectional Communication] (Slack API)
- [T1573.002 - Encrypted Channel: Asymmetric Cryptography]
- **[TA0002 - Execution]**
- [T1059 - Command and Scripting Interpreter]
## Functionality
### Core Capabilities
- **System Reconnaissance:** Collects hardware attributes, OS details, hostname, and node availability.
- **Dual C2 Channels:**
- **Slack C2:** Polls the `conversations.history` endpoint every 10 seconds using a hardcoded bot token to receive commands and handle file transfers (Start, Chunk, End packets).
- **Blockchain C2:** Uses the Arbitrum Sepolia testnet to retrieve encrypted commands from an Ethereum smart contract every 3 seconds.
- **Asymmetric Encryption:** Employs ephemeral public-private key pairs to generate shared keys, ensuring C2 communications are encrypted per-host and cannot be easily intercepted or decrypted by third parties.
### Advanced Features
- **Targeted Decryption:** Some variants only decrypt the final payload if the victim's system solves a specific linear system/cryptographic puzzle, likely to evade sandbox analysis.
- **Infrastructure Overlap:** Shares backend infrastructure with malicious npm and PyPI packages (e.g., *indexed-btree*, *mathmain*).
- **Automation Mimicry:** Uses GitHub Actions worker farms to manufacture high download counts, creating a false sense of legitimacy (social proof).
## Indicators of Compromise
- **File Names (Malicious Providers/Modules):**
- `gocommunity-io/dockerd`
- `kreuzwenker/docker` (Note: Impersonation of legitimate `kreuzwerker` provider)
- `gocommunity.io/orderedbtree`
- `gogets.dev/btreex`
- **Network Indicators:**
- `slack[.]com/api/conversations.history`
- Ethereum Sepolia Testnet (Smart Contract interaction)
- Arbitrum Sepolia Testnet
- **Behavioral Indicators:**
- `terraform init` or `go get` commands triggering unexpected outbound connections to Slack APIs.
- Periodic polling (3s and 10s intervals) to blockchain and messaging platforms.
## Associated Threat Actors
- **Lazarus Group / DPRK (North Korea):** Attributed based on overlaps with the Graphalgo campaign and social engineering tactics involving fake Web3 job offers.
## Detection Methods
- **Signature-based:** Monitoring for the specific Go module names and provider strings listed in IoCs.
- **Behavioral Detection:**
- Flagging developer workstations or CI/CD runners making outbound calls to `slack.com` via CLI tools.
- Identifying high-frequency polling to blockchain testnet RPC nodes from non-development environments.
- **YARA:** Scan binaries for hardcoded Slack API tokens and Ethereum contract addresses.
## Mitigation Strategies
- **Dependency Pinning:** Use specific versions and verify checksums (`terraform.lock.hcl`) for all providers.
- **Registry Whitelisting:** Restrict Terraform and Go to use only internal mirrors or verified namespaces.
- **Network Egress Filtering:** Restrict CI/CD pipelines and developer environments from reaching non-essential external APIs (e.g., Slack, Ethereum nodes).
- **Code Review:** Audit `main.tf` and `go.mod` files for typos in provider names (e.g., `kreuzwenker` vs `kreuzwerker`).
## Related Tools/Techniques
- **Graphalgo:** The parent campaign/malware variant.
- **Typosquatting:** The primary method for tricking developers into downloading the malicious modules.
- **Dead Drop Resolvers:** Utilizing blockchain smart contracts to host C2 instructions.