Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
Aikido said Go malware was distributed through HashiCorp Registry Terraform providers gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), plus Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The payloads overlap Graphalgo, a campaign ReversingLabs attributed to North Korean operators that approaches developers with fake Web3 jobs and malicious dependencies. The Go implant checks in over Slack, polls an Ethereum contract on Arbitrum Sepolia, collects system details, and can execute Go or JavaScript commands. Researchers also flagged related npm packages, and SentinelOne separately described TraderTraitor using weaponized Terraform lock files.
- Malicious Terraform providers appeared on HashiCorp's registry.
- Payloads overlap the DPRK-linked Graphalgo supply-chain campaign.
- Dual command channels use Slack and an Ethereum dead drop.
- The implant collects host details and can run Go or JavaScript.
- Fake job offers remain the reported initial-access lure.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1566.003 Spearphishing via ServiceT1102.001 Dead Drop ResolverT1102.002 Bidirectional CommunicationT1082 System Information Discovery
- Vendors
- HashiCorp
- Products
- Terraform
- Threat actors
- TraderTraitor
- Malware
- Graphalgo
- Countries
- North Korea
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.