Full Report
Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. [...]
Analysis Summary
# Incident Report: Compromise of Coder’s Registry Infrastructure
## Executive Summary
In August 2026, an unidentified threat actor compromised Coder’s Cloudflare infrastructure to inject unauthorized IP addresses into the pool for `registry.coder.com`. This allowed the attacker to serve malicious Terraform modules containing credential-stealing code to a subset of users. The incident resulted in the exfiltration of sensitive environment variables, API keys, and SSH keys to an attacker-controlled domain.
## Incident Details
- **Discovery Date:** August 31, 2026
- **Incident Date:** August 31, 2026 (07:35 UTC – 21:45 UTC)
- **Affected Organization:** Coder (and its downstream users)
- **Sector:** Technology / Software Development (DevOps & Infrastructure-as-Code)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Monday, August 31, 2026, 07:35 UTC
- **Vector:** Compromise of Coder’s Cloudflare infrastructure.
- **Details:** The attacker gained access to Coder's Cloudflare configuration and added unauthorized IP addresses to the origin pool for the module registry.
### Lateral Movement
- **Details:** After compromising the Cloudflare administrative layer, the attacker diverted traffic to their own infrastructure, effectively performing a Man-in-the-Middle (MitM) or redirection attack at the edge.
### Data Exfiltration/Impact
- **Details:** Malicious Terraform modules were delivered to users. When executed by provisioners, these modules scraped secrets (API keys, SSH keys, OIDC tokens, CI/CD credentials) and sent them to the attacker-controlled domain `coder-infra[.]com`.
### Detection & Response
- **How it was discovered:** Not explicitly stated, likely via internal monitoring or user reports of unauthorized registry behavior.
- **Response actions taken:** Removed unauthorized IPs from the Cloudflare pool, released patched versions (2.37.0, 2.36.4, 2.35.7, 2.34.9), and published SQL queries for users to identify compromised modules.
## Attack Methodology
- **Initial Access:** Compromise of Cloudflare infrastructure credentials/API.
- **Persistence:** Addition of unauthorized IPs to the registry's load-balancing pool.
- **Privilege Escalation:** Not applicable (infrastructure-level access achieved initially).
- **Defense Evasion:** Using legitimate Cloudflare routing to serve malicious content; mimicking legitimate registry artifacts.
- **Credential Access:** Automated scraping of environment variables, `coderd` configuration secrets, and terminal history.
- **Discovery:** Scanned infected hosts for cloud provider keys (AWS/GCP/Azure) and AI-tooling API keys.
- **Lateral Movement:** Attempted via stolen SSH keys and CI/CD credentials.
- **Collection:** Gathering OIDC tokens, SSH keys, and database passwords.
- **Exfiltration:** HTTPS POST requests to `coder-infra[.]com`.
- **Impact:** Compromise of customer cloud environments and development pipelines.
## Impact Assessment
- **Financial:** Potential for significant loss via stolen cloud credentials/resource hijacking.
- **Data Breach:** High-risk theft of secrets, keys, and tokens from private and government organizations.
- **Operational:** Disruption to developer workflows; requirement for massive secret rotation across affected organizations.
- **Reputational:** High impact due to Coder’s high-profile client base (U.S. Government, Palantir, Mercedes-Benz).
## Indicators of Compromise
- **Network Indicators:**
- `coder-infra[.]com` (Exfiltration domain)
- **File/Log Indicators:**
- `data.external.telemetry` (Presence in provisioner logs)
- Unauthorized IP addresses in Cloudflare origin logs (Specific IPs not disclosed in report).
## Response Actions
- **Containment:** Unauthorized registry servers were removed from the Cloudflare pool at 21:45 UTC.
- **Eradication:** Users advised to purge cached modules and rotate all secrets identified in the breach.
- **Recovery:** Released Coder versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9.
## Lessons Learned
- **Infrastructure Security:** Cloud management platforms (Cloudflare/AWS/GCP) are high-value targets; their compromise can bypass traditional software supply chain security.
- **Visibility Gaps:** Coder noted they cannot conclusively identify every compromised deployment because the attacker’s infrastructure was outside their logging control.
## Recommendations
- **MFA & Access Control:** Enforce hardware-based MFA for all Cloudflare and infrastructure administrative accounts.
- **Audit Logging:** Enable and monitor "Audit Logs" for all configuration changes in Cloudflare (e.g., DNS or Load Balancing changes).
- **Integrity Checking:** Implement subresource integrity (SRI) or module signing for Terraform modules to ensure that what is downloaded matches a known-good cryptographic hash.
- **Network Egress Filtering:** Restrict provisioner environments from making outbound connections to unknown or unauthorized domains.