Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT

A threat actor linked to the ongoing Graphalgo software supply-chain campaign has expanded beyond npm and PyPI, using malicious Terraform providers and Go modules to deliver a targeted Go-based remote access trojan (RAT).

The activity is significant because it marks the first observed case of malware being distributed through Terraform providers, placing infrastructure-as-code workflows directly in the campaign’s attack surface.

Researchers identified two trojanized Terraform providers, gocommunity-io/dockerd and kreuzwenker/docker, along with the malicious Go modules gocommunity.io/orderedbtree and gogets.dev/btreex.

The kreuzwenker/docker package impersonates the legitimate kreuzwerker/docker provider, which reports 56 million downloads, showing the actor’s deliberate attempt to exploit familiarity and typosquatting in the DevOps ecosystem.

The Terraform payloads hide their malicious entry point in internal/provider/resource_docker_container_funcs.go.

Execution is tightly gated: the malware only activates when the SHA-256 hash of concatenated containerName and networkID variables matches a hard-coded value.

This condition prevents broad execution during automated inspection and strongly suggests that the packages were built for selected victims rather than opportunistic mass compromise.

When triggered, the provider uses the derived SHA-256 value as an AES key to decrypt an embedded file path.

It then extracts an archive disguised as examples/resources/docker_container/import-resource.sqlite3, decrypts its contents, and launches the payload through a detached go run . process.

The ZIP archive hash is 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f.

The second stage is a Go RAT that collects operating-system, architecture, hostname, username, home-directory, hardware, and Node.js availability information.

It initially sends victim check-in data to a Slack channel named frontend-devs in the attacker-controlled Portfolio Devs workspace via Slack’s API.

This design encrypts communications individually, preventing infected systems from reading commands meant for other victims.

Its Slack command channel ultimately uses the qa-announcements channel in a separate workspace, Portfolio-testers.

In parallel, the RAT uses a blockchain dead-drop mechanism on the Arbitrum Sepolia testnet, querying the smart contract at 0xAD02b5cDE693529d3bdA0266299501ad0193036C.

The implant reads encrypted tasking data, registers its ephemeral public key through the setCPubKey method, and polls blockchain instructions every three seconds. Slack polling occurs every 10 seconds.

Graphalgo Malware

Decrypted commands can direct the implant to execute additional Go or JavaScript payloads through Node.js, or remove itself.

Aikido said in a report shared with GBhackers, the malware then creates an ephemeral public-private key pair and derives per-victim shared keys using attacker-controlled public keys.

This blend of Slack API traffic and testnet blockchain RPC traffic enables resilient command-and-control while reducing reliance on traditional attacker-controlled infrastructure.

The same malware appeared in gocommunity.io/orderedbtree, published on August 11, and gogets.dev/btreex, published on September 8.

The former contained the Go implant in plaintext, while the latter concealed it in a ZIP archive masquerading as a SQL file with SHA-256 hash ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5.

Like the Terraform packages, gogets.dev/btreex required a specially crafted input an object containing a specific integer price to activate.

The actor also used forged Git commits to backdate the module to November 2025.

Because Go Modules relies on commit timestamps, the falsified date propagated into the Go proxy and pkg.go.dev, creating a misleading appearance of package maturity.

The operators supported their packages with two apparently fake Go package ecosystems, gocommunity[.]io and gogets[.]dev.

Both domains were registered within one day of their associated GitHub organizations and claimed to offer vanity import paths, but lacked functional mechanisms for outside developers to publish packages.

The infrastructure appears designed solely to add legitimacy to attacker-controlled modules.

A hard-coded public key 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702 connects the Go payload to Graphalgo npm malware observed since at least April 2026.

Earlier research tied Graphalgo to fake recruiter lures targeting cryptocurrency and developer communities, malicious dependencies, staged encrypted payloads, and token-protected RAT infrastructure.

The campaign’s latest evolution is consistent with research into related encrypted npm loaders, which used precise cryptographic triggers and dual Slack/blockchain communications to limit activation to intended targets.

Organizations should immediately audit Terraform lock files, internal module proxies, Go module caches, and CI/CD build logs for the identified package names.

Security teams should also investigate outbound access to api.slack.com, public blockchain RPC services, and Arbitrum Sepolia from developer workstations or build infrastructure where such traffic has no operational purpose.

The activity demonstrates that software supply-chain threats are moving beyond conventional language registries.

Terraform providers, Go modules, GitHub organizations, package vanity domains, Slack workspaces, and blockchain testnets are being combined into a coordinated delivery system aimed at high-value development and DevOps targets.

IOCs

Category	Name / File	Version	SHA-256 Hash
Terraform Provider	gocommunity-io/dockerd	Any version	—
Terraform Provider	kreuzwenker/docker	Any version	—
Go Module	gocommunity.io/orderedbtree	Any version	—
Go Module	gogets.dev/btreex	Any version	—
File	import-resource.sqlite3	—	5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f
File	btreex.sql	—	ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC