Graphalgo (Malware): news timeline & CVEs

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.

Aikido said Go malware was distributed through HashiCorp Registry Terraform providers gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The payloads overlap Graphalgo, a campaign ReversingLabs attributed to North Korean operators that approaches developers with fake Web3 jobs and malicious dependencies. The Go implant checks in over Slack, polls an Ethereum contract on Arbitrum Sepolia, collects system details, and can execute Go or JavaScript commands. Researchers also flagged related npm packages, and SentinelOne separately described TraderTraitor using weaponized Terraform lock files.

The Hacker NewsSep 23, 18:06 UTC · 3d agoMalware in the wild 4 sources

Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT

Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.

The Graphalgo malware campaign has expanded its supply-chain attack vector beyond npm and PyPI to include malicious Terraform providers and Go modules. This marks the first observed case of malware distribution through Terraform providers, directly targeting infrastructure-as-code workflows. The malware deploys a Go-based RAT that uses Slack API and Arbitrum Sepolia testnet blockchain for command-and-control, with activation gated by cryptographic hashes to target specific victims.

GBHackersupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 10:00 UTC · 3d agoMalware in the wild 4 sources

The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths

Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.

A malicious campaign linked to the threat actor Graphalgo has been discovered distributing remote access malware via compromised Terraform providers and Go software packages. The malicious packages, which included a typosquatted Terraform provider, used complex activation triggers to hide their payloads and avoid detection. Once activated, the malware collected system information and communicated with command and control servers via Slack and Ethereum smart contract transactions. Researchers at Aikido identified the campaign and noted it represents the first observed malware distribution through Terraform providers.

Cyber Security Newsupdated Sep 23, 18:06 UTC · 3d agofirst Sep 23, 09:22 UTC · 4d agoMalware in the wild 4 sources

Graphalgo

Timeline3 articles

Appears with

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT

The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths