Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT
Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.
The Graphalgo malware campaign has expanded its supply-chain attack vector beyond npm and PyPI to include malicious Terraform providers and Go modules. This marks the first observed case of malware distribution through Terraform providers, directly targeting infrastructure-as-code workflows. The malware deploys a Go-based RAT that uses Slack API and Arbitrum Sepolia testnet blockchain for command-and-control, with activation gated by cryptographic hashes to target specific victims.
- Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules.
- First known malware distributed via Terraform providers.
- Uses Slack API and blockchain testnet for resilient command-and-control.
- Payload activation is cryptographically gated for targeted victims.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gocommunity.io | ir packages with two apparently fake Go package ecosystems, gocommunity[.]io and gogets[.]dev . Both domains were registered within on |
| domain | gogets.dev | apparently fake Go package ecosystems, gocommunity[.]io and gogets[.]dev . Both domains were registered within one day of their as |
| sha256 | 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f | hrough a detached go run . process. The ZIP archive hash is 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f . The second stage is a Go RAT that collects operating-syst |
| sha256 | ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 | a ZIP archive masquerading as a SQL file with SHA-256 hash ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 . Like the Terraform packages, gogets.dev/btreex required a |
From the original article
4 min read at gbhackers.com
A threat actor linked to the ongoing Graphalgo software supply-chain campaign has expanded beyond npm and PyPI, using malicious Terraform providers and Go modules to deliver a targeted Go-based remote access trojan (RAT). The activity is significant because it marks the first observed case of malware being distributed through Terraform providers, placing infrastructure-as-code workflows directly […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.