The Malware Hiding in Developer Tools That Turned Terraform Providers Into Attack Paths
Malware campaign distributes remote access tools via malicious Terraform providers and Go packages, using Slack and Ethereum smart contracts for command and control.
A malicious campaign linked to the threat actor Graphalgo has been discovered distributing remote access malware via compromised Terraform providers and Go software packages. The malicious packages, which included a typosquatted Terraform provider, used complex activation triggers to hide their payloads and avoid detection. Once activated, the malware collected system information and communicated with command and control servers via Slack and Ethereum smart contract transactions. Researchers at Aikido identified the campaign and noted it represents the first observed malware distribution through Terraform providers.
- A malware campaign planted remote access tools in malicious Terraform providers and Go packages, turning development tools into attack vectors.
- The malicious packages, linked to the threat actor Graphalgo, used obfuscation and activation triggers to evade casual testing.
- The malware used Slack and Ethereum smart contracts for command and control.
- Researchers observed infections across 18 distinct hostnames, including Windows, Linux, and Mac systems.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | gocommunity.io | Trigger hash used by the Terraform-provider payload Domain gocommunity[.]io Threat actor-controlled fake Go package ecosystem Domain |
| domain | gogets.dev | io Threat actor-controlled fake Go package ecosystem Domain gogets[.]dev Threat actor-controlled fake Go package ecosystem Public |
| domain | slack.com | ommand-and-control Slack workspace hxxps[:]//portfolio-devs.slack[.]com Workspace associated with initial host check-ins Slack wo |
| sha256 | 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f | lite3 Archive used by malicious Terraform providers SHA-256 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f Hash of import-resource.sqlite3 File btreex.sql Disguised a |
| sha256 | ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 | l Disguised archive used by the malicious Go module SHA-256 ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 Hash of btreex.sql SHA-256 b9966e3762e9a0d5d263b8cb3cca0729 |
| sha256 | b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 |
Full article901 words · extracted from cybersecuritynews.com · click to collapse
Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable machines.
The packages did not behave like obvious malicious downloads. Some waited for particular inputs before running hidden code, making casual testing less likely to reveal them.
The danger echoes earlier attacks using fake Terraform job tests, although this campaign used its own malicious packages and methods. Aikido analysts identified the Terraform and Go variants.
Aikido said in a report shared with Cyber Security News (CSN) that this was the first time its researchers had observed malware distributed through Terraform providers.
They connected the Go version to Graphalgo activity previously seen in npm packages. The known footprint appears limited rather than widespread.
Researchers counted 18 distinct hostnames in check-in messages, including three Windows systems, five Linux systems, and 10 Macs. Those records do not prove how many organizations were affected, but they show that the operation reached real machines.
The Malware Hiding in Developer Tools
Terraform providers let teams connect infrastructure plans to outside services. In early September, the attackers published two providers, one with a name closely resembling a popular Docker provider with 56 million reported downloads.
That lookalike mattered because a quick glance at a package name might not catch the missing letter. The hidden code sat in a provider source file and only activated when two Terraform input values produced a particular hash. Otherwise, it stayed quiet.
Once triggered, it decrypted the location of a disguised archive, unpacked its contents, decrypted the files inside, and ran the resulting Go code as a separate process.
.webp)
This is different from a recent Terraform registry compromise, in which attackers changed the material served by an existing registry. Here, the malicious providers themselves were the bait.
Both cases show why code running during infrastructure work deserves as much scrutiny as the infrastructure plan. The campaign also reached Go developers through two modules.
One exposed its malicious code in readable form; another hid it in an archive posing as a database file and waited for a specially crafted value. Attackers forged older commit dates for the latter, making its release appear more established than it was.
Remote Control and Response
After activation, the second stage collected system details and reported them through Slack. It then created temporary encryption keys to protect later messages.
The operator could send instructions through Slack or an Ethereum test network smart contract, directing infected systems to run more Go or JavaScript code or erase the malware.
This approach fits a wider pattern of Graphalgo attacks on developer packages, but the new research does not independently identify the operator behind these specific Terraform providers.
The researchers also found two fake Go package ecosystems apparently designed to make the offerings look credible. At analysis time, investigators saw 1,240 encrypted Slack messages and 1,402 smart contract transactions.
Those figures measure activity in the control channels, not confirmed infections. The use of a blockchain as a command route also resembles other malware hiding control instructions in public transactions, though the mechanisms differ.
For teams that installed the affected software, removing a package is not enough. Aikido advises isolating the machine or build runner, rotating credentials it could access, and reviewing recent code changes, package releases, Terraform runs, and automated builds for misuse. Reimaging the host is the safer way to remove a separate payload that may remain after uninstalling the package.
Cloud and infrastructure credentials deserve priority when a Terraform provider was involved. Organizations without a business reason to contact blockchain services can also alert on unexpected connections to blockchain web interfaces.
Teams should preserve logs and snapshots before cleanup, because they can reveal whether attackers used still-valid credentials elsewhere.
The central lesson is practical: software used to deploy infrastructure can itself become the entry point to that infrastructure.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Malicious Terraform provider | gocommunity-io/dockerd | Malicious Terraform provider |
| Malicious Terraform provider | kreuzwenker/docker | Typosquatted Terraform provider containing malware |
| Malicious Go module | gocommunity.io/orderedbtree | Go module containing malware in plaintext |
| Malicious Go module | gogets.dev/btreex | Go module containing malware in a disguised archive |
| File | import-resource.sqlite3 | Archive used by malicious Terraform providers |
| SHA-256 | 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f | Hash of import-resource.sqlite3 |
| File | btreex.sql | Disguised archive used by the malicious Go module |
| SHA-256 | ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 | Hash of btreex.sql |
| SHA-256 | b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 | Trigger hash used by the Terraform-provider payload |
| Domain | gocommunity[.]io | Threat actor-controlled fake Go package ecosystem |
| Domain | gogets[.]dev | Threat actor-controlled fake Go package ecosystem |
| Public key | 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702 | Hardcoded threat actor public key |
| Ethereum smart contract | 0xAD02b5cDE693529d3bdA0266299501ad0193036C | Arbitrum Sepolia contract used for command-and-control |
| Slack workspace | hxxps[:]//portfolio-devs.slack[.]com | Workspace associated with initial host check-ins |
| Slack workspace | hxxps[:]//portfolio-testers.slack[.]com | Workspace used for encrypted command communications |
| Slack workspace | hxxps[:]//mediumstar.slack[.]com | Historical unreported indicator |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.