The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
A malicious campaign linked to the threat actor Graphalgo has been discovered distributing remote access malware via compromised Terraform providers and Go software packages. The malicious packages, which included a typosquatted Terraform provider, used complex activation triggers to hide their payloads and avoid detection. Once activated, the malware collected system information and communicated with command and control servers via Slack and Ethereum smart contract transactions. Researchers at Aikido identified the campaign and noted it represents the first observed malware distribution through Terraform providers.
- A malware campaign planted remote access tools in malicious Terraform providers and Go packages, turning development tools into attack vectors.
- The malicious packages, linked to the threat actor Graphalgo, used obfuscation and activation triggers to evade casual testing.
- The malware used Slack and Ethereum smart contracts for command and control.
- Researchers observed infections across 18 distinct hostnames, including Windows, Linux, and Mac systems.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gocommunity.io | Trigger hash used by the Terraform-provider payload Domain gocommunity[.]io Threat actor-controlled fake Go package ecosystem Domain |
| domain | gogets.dev | io Threat actor-controlled fake Go package ecosystem Domain gogets[.]dev Threat actor-controlled fake Go package ecosystem Public |
| sha256 | 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f | lite3 Archive used by malicious Terraform providers SHA-256 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f Hash of import-resource.sqlite3 File btreex.sql Disguised a |
| sha256 | ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 | l Disguised archive used by the malicious Go module SHA-256 ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 Hash of btreex.sql SHA-256 b9966e3762e9a0d5d263b8cb3cca0729 |
| sha256 | b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 | 93667b07ec217a61cbd798f5695d62f5 Hash of btreex.sql SHA-256 b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 Trigger hash used by the Terraform-provider payload Domain |
| url | https://mediumstar.slack.com | e used for encrypted command communications Slack workspace hxxps[:]//mediumstar.slack[.]com Historical unreported indicator Note: IP addresses and |
| url | https://portfolio-devs.slack.com | polia contract used for command-and-control Slack workspace hxxps[:]//portfolio-devs.slack[.]com Workspace associated with initial host check-ins Slack |
| url | https://portfolio-testers.slack.com | pace associated with initial host check-ins Slack workspace hxxps[:]//portfolio-testers.slack[.]com Workspace used for encrypted command communications Sla |
From the original article
4 min read at cybersecuritynews.com
Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable machines. The packages did not behave like obvious malicious downloads.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.