Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Threat actors are leveraging HashiCorp's Terraform Registry as a new distribution vector for Go-based malware, marking a significant expansion of their tactics beyond traditional npm and PyPI package repositories. This campaign, linked to North Korean (DPRK) threat actors, utilizes malicious Terraform providers and Go modules to deliver a sophisticated malware payload that employs blockchain dead drops and Slack communication for command and control. The attack chain involves a series of deceptive job interviews and credential compromise to gain access to developer accounts, allowing for the deployment of malicious code. This tactic follows a pattern seen in the Contagious Interview campaign and the PolinRider campaign, highlighting the adaptive nature of North Korean adversaries and their ongoing efforts to expand their reach and exploit new supply chain vulnerabilities.
Cybersecurity researchers have disclosed a new method by which threat actors are distributing Go-based malware through HashiCorp's Terraform Registry, a significant expansion of their attack vector beyond traditional package repositories like npm and PyPI. This campaign is linked to North Korean (DPRK) threat actors and utilizes malicious Terraform providers and Go modules to deliver a complex malware payload.
According to Aikido, the list of Terraform providers and Go modules involved includes `gocommunity-io/dockerd`, `kreuzwenker/docker`, `gocommunity.io/orderedbtree`, `gogets.dev/btreex`. The malware deployed through these packages demonstrates overlaps with Graphalgo, a campaign documented by ReversingLabs earlier this February.
Threat actors are approaching prospective developers via social platforms like LinkedIn and Facebook, or through job offerings on forums, posing as non-existent Web3 companies. They then request a coding task – providing a benign GitHub repository that introduces the malicious behavior via a dependency published on npm or PyPI. The latest discovery coincides with the identification of a new set of malicious npm packages delivering the same malware, as highlighted by Checkmarx, JFrog, and SafeDep.
The malware leverages blockchain and Slack infrastructure, decrypting remote data, writing subwatcher, and starting it with Node.js. It collects system information, including hardware attributes, operating system, hostname, and whether the node is available on the infected system, transmitting this data to an attacker-controlled Slack channel. The payload decrypts only when a specific cryptographic operation is performed, taking its orders from a smart contract on the Ethereum Sepolia testnet, keeping a second command channel open over Slack, and hiding behind download counts manufactured by a farm of GitHub Actions workers.
“The C2 mechanism is further indication that this malware is part of a targeted operation,” said Oliver Smith. “The threat actor’s ability to issue commands is bottlenecked because all clients consume all messages and no-op when they fail to decrypt messages intended for other clients.”
Researchers have observed a similar tactic in the Contagious Interview campaign, where attackers set up video calls for seemingly legitimate purposes – such as job interviews – to trick victims into installing malicious software or executing commands. The Rust project has issued a warning about a related campaign targeting rust-lang members and owners of popular crates, urging caution and enabling multi-factor authentication (MFA).
“It is too early to conclude with confidence that DPRK-linked threat actors are using Terraform registries as a new distribution tactic,” said Zanki. “Nevertheless, their recent appearance in two separate campaigns associated with these operators makes coincidence less likely.”
CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER, distributed following the compromise of a legitimate npm package, `@dforge-core/dforge-mcp`. The loader fetches code from a server the operator controls and runs it, allowing the threat actor to dynamically alter payloads at run-time. The malicious version (0.2.21) remained live on npm for 35 minutes and 38 seconds before the original maintainer reverted the changes and published a clean version (0.2.22). The same loader has been observed in 65 public repositories belonging to 22 distinct accounts.
“It reached them the same way in each case: the operator obtained a developer's stored credentials, and then used those credentials to write into every repository that developer could push to,” CloudSEK researcher Vikas Kundu said.
Interestingly, the second payload has been observed using the NullReceiver technique to obtain its C2 address (