Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, turning routine development work into a possible route onto valuable machines.
The packages did not behave like obvious malicious downloads. Some waited for particular inputs before running hidden code, making casual testing less likely to reveal them.
The danger echoes earlier attacks using fake Terraform job tests, although this campaign used its own malicious packages and methods. Aikido analysts identified the Terraform and Go variants.
Aikido said in a report shared with Cyber Security News (CSN) that this was the first time its researchers had observed malware distributed through Terraform providers.
They connected the Go version to Graphalgo activity previously seen in npm packages. The known footprint appears limited rather than widespread.
Researchers counted 18 distinct hostnames in check-in messages, including three Windows systems, five Linux systems, and 10 Macs. Those records do not prove how many organizations were affected, but they show that the operation reached real machines.
Terraform providers let teams connect infrastructure plans to outside services. In early September, the attackers published two providers, one with a name closely resembling a popular Docker provider with 56 million reported downloads.
That lookalike mattered because a quick glance at a package name might not catch the missing letter. The hidden code sat in a provider source file and only activated when two Terraform input values produced a particular hash. Otherwise, it stayed quiet.
Once triggered, it decrypted the location of a disguised archive, unpacked its contents, decrypted the files inside, and ran the resulting Go code as a separate process.
This is different from a recent Terraform registry compromise, in which attackers changed the material served by an existing registry. Here, the malicious providers themselves were the bait.
Both cases show why code running during infrastructure work deserves as much scrutiny as the infrastructure plan. The campaign also reached Go developers through two modules.
One exposed its malicious code in readable form; another hid it in an archive posing as a database file and waited for a specially crafted value. Attackers forged older commit dates for the latter, making its release appear more established than it was.
Remote Control and Response
After activation, the second stage collected system details and reported them through Slack. It then created temporary encryption keys to protect later messages.
The operator could send instructions through Slack or an Ethereum test network smart contract, directing infected systems to run more Go or JavaScript code or erase the malware.
This approach fits a wider pattern of Graphalgo attacks on developer packages, but the new research does not independently identify the operator behind these specific Terraform providers.
The researchers also found two fake Go package ecosystems apparently designed to make the offerings look credible. At analysis time, investigators saw 1,240 encrypted Slack messages and 1,402 smart contract transactions.
Those figures measure activity in the control channels, not confirmed infections. The use of a blockchain as a command route also resembles other malware hiding control instructions in public transactions, though the mechanisms differ.
For teams that installed the affected software, removing a package is not enough. Aikido advises isolating the machine or build runner, rotating credentials it could access, and reviewing recent code changes, package releases, Terraform runs, and automated builds for misuse. Reimaging the host is the safer way to remove a separate payload that may remain after uninstalling the package.
Cloud and infrastructure credentials deserve priority when a Terraform provider was involved. Organizations without a business reason to contact blockchain services can also alert on unexpected connections to blockchain web interfaces.
Teams should preserve logs and snapshots before cleanup, because they can reveal whether attackers used still-valid credentials elsewhere.
The central lesson is practical: software used to deploy infrastructure can itself become the entry point to that infrastructure.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Malicious Terraform provider | gocommunity-io/dockerd | Malicious Terraform provider |
| Malicious Terraform provider | kreuzwenker/docker | Typosquatted Terraform provider containing malware |
| Malicious Go module | gocommunity.io/orderedbtree | Go module containing malware in plaintext |
| Malicious Go module | gogets.dev/btreex | Go module containing malware in a disguised archive |
| File | import-resource.sqlite3 | Archive used by malicious Terraform providers |
| SHA-256 | 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f | Hash of import-resource.sqlite3 |
| File | btreex.sql | Disguised archive used by the malicious Go module |
| SHA-256 | ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5 | Hash of btreex.sql |
| SHA-256 | b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 | Trigger hash used by the Terraform-provider payload |
| Domain | gocommunity[.]io | Threat actor-controlled fake Go package ecosystem |
| Domain | gogets[.]dev | Threat actor-controlled fake Go package ecosystem |
| Public key | 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702 | Hardcoded threat actor public key |
| Ethereum smart contract | 0xAD02b5cDE693529d3bdA0266299501ad0193036C | Arbitrum Sepolia contract used for command-and-control |
| Slack workspace | hxxps[:]//portfolio-devs.slack[.]com | Workspace associated with initial host check-ins |
| Slack workspace | hxxps[:]//portfolio-testers.slack[.]com | Workspace used for encrypted command communications |
| Slack workspace | hxxps[:]//mediumstar.slack[.]com | Historical unreported indicator |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
