Malware Sneaks Into HashiCorp Registry via Rogue Terraform Providers

Researchers at Aikido have disclosed Go-based malware that attackers pushed through several channels of the HashiCorp registry. For the first time, the centralized HashiCorp repository was used as a vector to deliver a malicious payload.

The tainted packages include two Terraform providers (gocommunity-io/dockerd, 222 downloads, and kreuzwenker/docker, 1,449 downloads) and two Go modules (gocommunity.io/orderedbtree and gogets.dev/btreex). The code overlaps with Graphalgo, a campaign first documented by ReversingLabs in February and attributed to a North Korean group.

Luring the developer

The scheme begins outside the code: developers are approached on LinkedIn and Facebook or via job listings, with the attackers posing as non-existent Web3 firms, then asked to complete a "coding task" using a benign-looking repository whose malicious behavior arrives through an npm or PyPI dependency. In parallel, Checkmarx, JFrog and SafeDep flagged a fresh batch of npm packages this week carrying the same malware.

A sophisticated build

The payload is wrapped in asymmetric cryptography, so its ultimate functions remain unknown. As JFrog notes, in some cases decryption fires only when the victim solves a linear system with one specific matrix — a clear sign of a targeted operation. Command and control runs over two channels: an Ethereum smart contract (Sepolia in the npm version, Arbitrum Sepolia in the Go port) and a Slack bot, whose message history the implant polls every few seconds.

On launch the Go variant gathers system details — hardware, OS, hostname — and ships them to an attacker-controlled Slack channel. It then generates an ephemeral key pair and, combining it with two threat-actor public keys, derives shared keys. This, says researcher Oliver Smith, lets the malware talk to its C2 without exposing traffic or leaking messages between infected hosts. The download counts, incidentally, were inflated by a farm of GitHub Actions workers.

A new supply-chain channel?

The appearance of Terraform providers makes grim sense: they offer a direct path to critical production credentials. As Aikido recalls, SentinelOne described the TraderTraitor cluster a week earlier delivering Rust backdoors from attacker-run Terraform registries. Socket's Karlo Zanki calls a firm conclusion premature, but two independent cases make coincidence unlikely: Terraform registries may be the next distribution channel these groups adopt at scale.

Separately, the Rust project warned of a campaign against maintainers of popular crates: under the guise of a video call about a job or contract, victims are nudged to install a "missing codec" or run a command. The tradecraft matches the known Contagious Interview operation.

Source: The Hacker News