Go Malware Spread via Malicious Terraform Providers

Security researchers have disclosed a Go-based malware campaign that uses malicious Terraform providers and Go modules published through the HashiCorp Terraform Registry, marking the first time threat actors have used this centralized repository as a distribution vector for malicious payloads. According to Aikido, the two Terraform providers and two Go modules involved are gocommunity-io/dockerd (222 downloads), kreuzwenker/docker (1,449 downloads), gocommunity.io/orderedbtree and gogets.dev/btreex. The malware delivered through these packages shows overlaps with Graphalgo, a campaign first documented by ReversingLabs in February and attributed to North Korean (DPRK) threat actors.

The attackers approach prospective developers on LinkedIn, Facebook or job forums while posing as non-existent Web3 companies, then ask them to complete a coding task by providing a benign GitHub repository that introduces malicious behavior through a dependency published on npm or PyPI. The latest discovery coincides with identification of a new set of malicious npm packages flagged by Checkmarx, JFrog and SafeDep, including indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js and graphlib-js. Analysis shows that in some cases malware execution triggers only when a specific cryptographic operation is performed, a hallmark of a targeted operation.

JFrog described the payload behavior: it decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers. The implant is encrypted with asymmetric cryptography, so its exact functions remain unknown. It contacts a Slack channel and polls the conversations.history endpoint every 10 seconds, acting on three packet types: start packet to begin a file transfer, chunk packet to supply file content, and end packet to join the chunks. SafeDep noted that the blockchain path decrypts remote data, writes a program called subwatcher, and starts it with Node.js, but the researchers recovered the implant and not the later code delivered through these channels, so they cannot say what tasks an operator ran on a victim.

Aikido found that the malware distributed through the Terraform providers and Go modules is a Go port that shares blockchain and Slack infrastructure with the npm version. It has dual command-and-control (C2) channels using blockchain dead drops and a Slack bot token. After infection, it collects system information including hardware attributes, operating system, hostname and whether Node.js is available, then sends that data to an attacker-controlled Slack channel over the API. Security researcher Oliver Smith explained that after the check-in call, the malware generates an ephemeral public-private key pair and combines it with two threat actor public keys to create shared keys, allowing communication through shared channels without exposing C2 messages between infected hosts. The blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address and polls for encrypted commands every three seconds, executing them as Go or JavaScript code. Smith said this mechanism is further indication of a targeted operation because all clients consume all messages and no-op when they fail to decrypt messages intended for other clients.

Socket security researcher Karlo Zanki told The Hacker News that Graphalgo continues to follow the same operational playbook, likely using fake job interviews as the primary initial access vector. Execution is gated by a basic check for data likely supplied by the front-end component, which could suggest narrowly targeted activity but more likely hinders analysis if researchers discover the backend payload without the corresponding front end. The original Graphalgo operation exhibited the same characteristic.

The appearance of Terraform providers is a novel tactic, but Aikido added that it is perhaps unsurprising because it can provide a more direct pathway to critical production credentials, and it shows the threat actor expanding the campaign beyond npm and PyPI. This is not the first time North Korean adversaries have used Terraform providers for malware distribution. SentinelOne reported last week that the threat activity cluster TraderTraitor used weaponized Terraform lock files to deliver Rust-based backdoors from custom Terraform provider registries controlled by the attackers. Zanki said it is too early to conclude with confidence that DPRK-linked threat actors are using Terraform registries as a new distribution tactic, but their recent appearance in two separate campaigns makes coincidence less likely. He added that these actors are highly adaptive and may adopt Terraform registries as their next distribution channel at scale.

Separately, CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER that was distributed after the compromise of a legitimate npm package, @dforge-core/dforge-mcp. It is currently not known how attackers gained access to the maintainer's account, though it is suspected the developer's machine may have been infected by a malicious extension or package. The malicious version 0.2.21 remained live on npm for 35 minutes and 38 seconds on September 9, 2026 before the original maintainer reverted the changes and published a clean version 0.2.22. The same loader was observed in 65 public repositories belonging to 22 distinct accounts. CloudSEK researcher Vikas Kundu said the operator obtained a developer's stored credentials and then used those credentials to write into every repository that developer could push to. A comparison of two copies of the loader, one from the npm package and another from a second victim's repository, showed the attack chain uses the same staging host and request to a Vercel domain but differs in the campaign tag, ghappier versus g0115. The second payload uses the NullReceiver technique to obtain its C2 address 193.247.144[.]38 from an attacker wallet and features the trailing byte sequence 68656c6c6f6970626f742121 that decodes to helloipbot!!. This activity overlaps with a long-running North Korea-linked campaign known as PolinRider.

The Rust project also warned of an ongoing campaign targeting rust-lang members and owners of popular crates, aiming to compromise their devices and accounts for malware distribution. Adam Harvey, a software developer at the Rust Foundation, said attackers set up a video call for something positive such as a job, project or contract opportunity and then use it to get the target to install something such as a purportedly missing audio codec or execute a command placed on the clipboard. They create new but legitimate-seeming company profiles, including plausib