Security researchers have uncovered a novel supply chain attack: Go-based malware being distributed through Terraform providers hosted in HashiCorp’s official registry. This marks the first time threat actors have used Terraform’s provider mechanism as a delivery route for malicious payloads. The operation also involves Go modules, mimicking infrastructure previously observed in npm and PyPI-based campaigns.
How the Attack Works
The malicious Terraform providers identified on registry.terraform.io include gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads). Alongside those, two Go modules—gocommunity.io/orderedbtree and gogets.dev/btreex—have also been used to distribute malware. The payload shares components with a previously documented campaign known as Graphalgo, which security analysts had traced back to North Korean threat actors earlier this year.
Initial access is achieved through fake recruitment and coding assignments. Victims are lured via platforms like LinkedIn and Facebook, then asked to complete coding tasks based on benign GitHub repositories. Malicious behavior is introduced later via dependencies published in npm or PyPI that the victim’s project includes.
Advanced Command & Control and Evasive Techniques
The malware employs a sophisticated dual command-and-control (C2) infrastructure, leveraging blockchain and Slack channels. Commands are encrypted and delivered using an Ethereum smart contract on the Arbitrum Sepolia testnet. Meanwhile, Slack is used for system reconnaissance, sending host info—like OS, hardware specs, and hostname—via its API. The malware remains dormant until very specific cryptographic and operational conditions are met, such as solving a particular linear system tied to a matrix, at which point execution is triggered. Download counts appear artificially inflated using GitHub Actions-based automation.
Although the implant itself has been recovered, further stages of code delivered through the Slack or blockchain channels remain unknown. These later payloads are triggered only under the right preconditions, making them difficult to analyze safely. Researchers emphasize that all clients poll every message uniformly; only those able to decrypt commands meant for them will act, making it harder to tie activity back to specific victims.
Expansion Beyond npm and PyPI
This activity represents an expansion of known DPRK-linked campaigns into new delivery vectors. Until now, malicious modules distributed via npm and PyPI were the primary concern. But the use of Terraform providers represents a new layer of risk, especially since providers often have access to deeper infrastructure and more sensitive credentials. Previous campaigns, such as one called TraderTraitor, have also utilized custom provider registries to deliver backdoors, indicating a pattern of escalating experimentation by these threat actors.
Additionally, security firms have spotted a malicious npm package loader named GHAPPIER. That loader appeared in version 0.2.21 of a legitimate package, stayed live for just over 35 minutes on September 9, 2026, and infected at least 65 public repositories under 22 different user accounts. The loader, probably introduced via compromised credentials or infected developer machines, dynamically fetched payloads and used similar techniques—such as remote code fetchers and specialized C2 channels—as seen in the Terraform-based malware.
Warnings have also been issued by open source communities such as Rust, following reports of other job-interview–style lure campaigns. Attackers reached out to Rust developers or crate maintainers with what appeared to be legitimate offers, only to try to trick them into installing malicious tools, executing commands, or otherwise compromising their machines. The Rust Foundation urged users to enable multi-factor authentication and keep an eye out for strange job offers or login activity.
This attack campaign demonstrates an evolving playbook: DPRK-linked operators are now using the Terraform Registry to distribute Go malware. With dual-channel C2 infrastructure and execution gates tied to cryptographic conditions, this malware is built for stealth and targeted impact. The move signals that even components once considered peripheral—like infrastructure-as-code providers—are no longer safe by default. Going forward, security teams should audit Terraform providers with the same scrutiny applied to modules or npm packages, enforce strict dependency verification, and monitor for unusual registry downloads or third-party supply chain alerts.
