Attackers Use Malicious Terraform Providers to Deliver Go Malware via Hashi Corp Registry
Summary: Researchers disclosed Go-based malware distributed through two Go Modules and two Terraform providers, the first known use of HashiCorp's centralized registry as a distribution vector, with the payload overlapping the Graphalgo campaign attributed to North Korean threat actors. The implant uses dual command-and-control channels - polling an Ethereum smart contract on the Arbitrum Sepolia testnet every three seconds and a Slack bot token - after collecting hardware attributes, operating system, and hostname from infected systems.
Key Takeaway: The operators reach victims through fake Web3 job offers and coding tasks, and Aikido notes Terraform providers offer a more direct pathway to critical production credentials than npm or PyPI ever did.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026