Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.

According to Aikido, the list of Terraform providers and Go modules is below -

• gocommunity-io/dockerd (222 downloads)
• kreuzwenker/docker (1,449 downloads)
• gocommunity.io/orderedbtree
• gogets.dev/btreex

The malware deployed through these packages demonstrates overlaps with Graphalgo, a campaign that was first documented by ReversingLabs earlier this February and attributed to North Korean (aka DPRK) threat actors.

As part of this effort, prospective developers are approached via social platforms like LinkedIn and Facebook, or through job offerings on forums by posing as non-existent Web3 companies, and then asked to complete a coding task by providing a benign GitHub repository that introduces the malicious behavior via a dependency published on npm or PyPI.

It's worth noting that the latest discovery coincides with the identification of a new set of malicious npm packages as recently as this week for delivering the same malware. A list of some of the flagged packages, as highlighted by Checkmarx, JFrog, and SafeDep, is as follows -

• indexed-btree
• mathsbase
• mathmain
• math-universe
• modern-events
• quick-events
• crypto-hasher
• events-router
• sort-btree
• graphcore-js
• graphlib-js

An analysis of these packages shows that, in some cases, the malware execution is triggered only when a specific cryptographic operation is performed, exhibiting all hallmarks of a targeted operation.

"The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog said.

The attack chain paves the way for an encrypted payload whose exact functions remain unknown due to the fact that it's encrypted with asymmetric cryptography. The implant is also designed to contact a Slack channel and polls the "conversations.history" endpoint every 10 seconds and performs the next action based on the packet type -

• Start packet, to begin a file transfer
• Chunk packet, to supply file content
• End packet, to join the chunks

"The blockchain path also decrypts remote data, writes subwatcher, and starts it with Node.js," SafeDep said. "These paths let an operator deliver code for execution on a host where the required setup succeeds. We recovered the implant, but not the later code delivered through these channels. We therefore cannot say what tasks an operator ran on a victim."

Aikido said the malware distributed through the Terraform providers and Go Modules is a Go port that shares blockchain and Slack infrastructure with the npm version. It features dual command-and-control (C2) channels, using blockchain dead drops and a Slack bot token.

At the outset, it collects system information, including hardware attributes, operating system, hostname, and whether the node is available on the infected system. The captured data is then transmitted to the attacker-controlled Slack channel over the API.

"Following the check-in call, the malware generates an ephemeral public-private key pair," security researcher Oliver Smith said. "The malware generates shared keys by combining its ephemeral key with two threat actor public keys. The shared key allows the malware to communicate with infected clients using shared channels without exposing C2 communications or leaking messages between infected hosts."

The blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address, using it to poll for encrypted commands every three seconds. The commands are then executed either as Go or JavaScript code.

"The C2 mechanism is further indication that this malware is part of a targeted operation," Smith said. "The threat actor's ability to issue commands is bottlenecked because all clients consume all messages and no-op when they fail to decrypt messages intended for other clients."

"This is a notably sophisticated implementation of a blockchain dead drop that integrates bidirectional communication with minimal risk of information leakage or disruption."

Socket security researcher Karlo Zanki told The Hacker News that Graphalgo continues to stick to the same operational playbook, likely using fake job interviews as the primary initial access vector.

"Execution is gated by a basic check for data likely supplied by the front-end component," Zanki said. "Although this behavior could suggest narrowly targeted activity, it is more likely intended to hinder analysis if researchers discover the backend payload without the corresponding front end. The original Graphalgo operation exhibited the same characteristic."

Is Terraform Registry the New Supply Chain Attack Vector?

The appearance of Terraform providers is a novel tactic, but one that's perhaps entirely unsurprising as it can provide a more direct pathway to critical production credentials, Aikido added. It also illustrates the threat actor is expanding the campaign's reach by going beyond npm and PyPI.

However, this is not the first time North Korean adversaries have resorted to using Terraform providers for malware distribution. In a report published last week, SentinelOne detailed how the threat activity cluster codenamed TraderTraitor relied on weaponized Terraform lock files to facilitate the delivery of Rust-based backdoors from custom Terraform provider registries controlled by the attackers.

"It is too early to conclude with confidence that DPRK-linked threat actors are using Terraform registries as a new distribution tactic," Zanki said. "Nevertheless, their recent appearance in two separate campaigns associated with these operators makes coincidence less likely. These threat actors have a history of introducing new infection techniques and applying successful methods across multiple campaigns."

"DPRK-linked threat actors are highly adaptive and continually expand their toolsets with techniques that can reach a broad range of targets. Terraform registries may represent the next distribution channel they adopt at scale."

Malicious npm Package Shares Links to PolinRider

The development comes as CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER that was distributed following the compromise of a legitimate npm package, "@dforge-core/dforge-mcp." It's currently not known how the attackers gained access to the maintainer's account, although it's suspected that the developer's machine may have been infected by a malicious extension or package..

The primary objective of the loader is to fetch code from a server the operator controls and run it, allowing the threat actor to dynamically alter payloads at run-time.

The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22). The same loader has been observed in 65 public repositories belonging to 22 distinct accounts.

"It reached them the same way in each case: the operator obtained a developer's stored credentials, and then used those credentials to write into every repository that developer could push to," CloudSEK researcher Vikas Kundu said.

A comparison of two copies of the loader – one from the npm package and another obtained from a second victim's repository – has revealed the attack chain uses the same staging host and request to a Vercel domain but differs in the campaign tag used ("ghappier" vs. "g0115").

Interestingly, the second payload has been observed using the NullReceiver technique to obtain its C2 address ("193.247.144[.]38") from an attacker wallet and features the same trailing byte sequence ("68656c6c6f6970626f742121") that decodes to the string "helloipbot!!." This activity overlaps with a long-running North Korea-linked campaign known as PolinRider.

Rust Warns of Job Interviews with a Malicious Payload

The findings also follow a warning from the Rust project about an ongoing campaign targeting rust-lang members and owners of popular crates with the goal of compromising their devices and accounts for malware distribution.

"A video call is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," Adam Harvey, a software developer at the Rust Foundation, said.

"These attackers are setting up new but legitimate-seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection."

The Rust project said the modus operandi overlaps with the Contagious Interview campaign tied to North Korea, urging contributors and crate owners to exercise caution, ensure multi-factor authentication (MFA) is enabled, and check their accounts for unexpected logins.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.