North Korean Hackers Exploit Terraform Registry to Deliver Go Malware

For the first time, threat actors have used the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.

Aikido: Malicious Terraform providers and Go modules discovered

Security firm Aikido reported that Go-based malware was distributed via two Terraform providers and two Go modules published to public registries. The packages Aikido flagged are gocommunity-io/dockerd (222 downloads), kreuzwenker/docker (1,449 downloads), gocommunity.io/orderedbtree and gogets.dev/btreex. Aikido said this marks the first observed use of HashiCorp's centralized Terraform Registry as a delivery channel for malicious code.

Overlap with Graphalgo and reuse across npm, PyPI, Go and Terraform

Researchers say the Go/Terraform artifacts share infrastructure and technique with a campaign called Graphalgo, which ReversingLabs documented in February and attributed to North Korean (DPRK) threat actors. The same malware family has been observed in malicious npm packages identified this week by Checkmarx, JFrog and SafeDep. Those npm packages include indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js and graphlib-js.

Analysis shows the malicious code sometimes executes only when a specific cryptographic operation is performed, consistent with a narrowly targeted gating mechanism. "The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog wrote.

Dual command-and-control: blockchain dead drops and Slack polling

Aikido and other researchers describe a sophisticated dual C2 design. The implant generates an ephemeral public-private key pair after initial check-in and derives shared keys by combining that ephemeral key with two threat actor public keys, a mechanism Oliver Smith described as allowing communication "without exposing C2 communications or leaking messages between infected hosts."

The malware uses a blockchain-based dead drop and a Slack channel. SafeDep said the implant polls Slack's "conversations.history" endpoint every 10 seconds and acts on three packet types: Start (to begin a file transfer), Chunk (to supply file content) and End (to join the chunks). Aikido added that the Go port shares blockchain and Slack infrastructure with the previously observed npm version and that the blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address and polls for encrypted commands every three seconds.

Commands fetched from the chain can be executed as Go or JavaScript code. As SafeDep summarized, operators can "deliver code for execution on a host where the required setup succeeds," but researchers recovered the implant itself and not the later, encrypted code delivered through these channels.

Initial access: fake job offers, interview ruses, and developer account compromise

Researchers traced initial access to social engineering and developer account compromises. Prospective contributors were approached on LinkedIn and Facebook or through forum job postings posing as non-existent Web3 companies. Targets were asked to complete a coding task by providing a benign GitHub repository; that repository introduced malicious behavior through a dependency published on npm or PyPI.

CloudSEK detailed a JavaScript loader, GHAPPIER, distributed after a compromise of the legitimate npm package @dforge-core/dforge-mcp. The malicious version (0.2.21) remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the maintainer reverted the change and published a clean 0.2.22. CloudSEK said the same loader was observed in 65 public repositories across 22 accounts and concluded the operator obtained stored developer credentials and used them to push the loader where the developer had access. Vikas Kundu of CloudSEK said, "It reached them the same way in each case: the operator obtained a developer's stored credentials, and then used those credentials to write into every repository that developer could push to."

The loader family has technical overlap with long-running activity dubbed PolinRider: one observed payload used the NullReceiver technique to obtain its C2 address (193.247.144[.]38) and included a trailing byte sequence that decodes to "helloipbot!!."

The Rust project has separately warned of interview-based lures that ask targets to install purported codecs or run commands during video calls. Adam Harvey of the Rust Foundation described attackers creating legitimate-seeming company profiles and video calls to induce victims to install software or execute commands.

What this means for open-source maintainers, enterprise security teams, and registries

• Open-source maintainers: CloudSEK's findings show account and credential theft can propagate malicious loaders across multiple repositories; maintainers should guard stored credentials and monitor for unexpected pushes. The GHAPPIER incident demonstrates how a short-lived publish (35 minutes, 38 seconds) can still spread a reusable loader into dozens of projects.
• Enterprise security teams and production operators: Aikido warned that Terraform providers give a "more direct pathway to critical production credentials." SentinelOne reported a related TraderTraitor campaign that weaponized Terraform lock files and custom provider registries to deliver Rust backdoors, illustrating how infrastructure-as-code artifacts can be abused to reach high-value credentials.
• Registry operators and supply-chain defenders: The campaign crosses npm, PyPI, Go modules and now Terraform providers. JFrog, SafeDep and others note the attackers are reusing infrastructure and gating techniques, and Karlo Zanki observed that DPRK-linked actors have been applying successful infection techniques across multiple campaigns, making registry-level detection and credential hygiene urgent concerns.

The record in these combined reports is clear: malicious actors are expanding across language ecosystems and package registries while stitching together a compact, encrypted command architecture that uses both public blockchains and widely used collaboration platforms. Whether registries, maintainers, and defenders can blunt that modular playbook will shape how quickly similar campaigns can be contained.

Original reporting: The Hacker News — Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry