Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
A malware campaign that was discovered early this year targeting JavaScript and Python developers with cryptocurrency-related fake recruiter tasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.
It is the first time the company’s research team has observed malware distributed through Terraform providers. Aikido security researcher Oliver Smith wrote in a September post that the malware overlaps with the Graphalgo npm campaign that ReversingLabs researchers first reported in February.
The Terraform campaign uses a version of the Graphalgo malware written in Go, and it shares blockchain and Slack infrastructure and a public key with recent JavaScript samples being distributed via npm.
Smith also found that the threat actor stood up at least two fake package ecosystems, gogets[.]dev and gocommunity[.]io, to make its packages look legitimate, a sign of sustained interest in the Go ecosystem.
Shane Barney, chief information security officer at Keeper Security, interprets the move onto the official HashiCorp Terraform Registry as a deliberate step further upstream in the development lifecycle. While npm package poisoning mostly reaches web application developers, Terraform providers reach cloud engineers, system administrators, and DevOps staff, the people who hold the highest administrative privileges in most enterprises and build infrastructure as code (IaC). Advanced persistent threat groups are repurposing and industrializing their supply chain campaign infrastructure across programming ecosystems and infrastructure layers, Barney added.
“Once adversaries transition from compromising application code to compromising IaC provisioning tools, the blast radius shifts from a single app to the entire underlying cloud environment.”
—Shane Barney
Here’s why the Terraform and Go attacks matter — and what you need to know about them.
[ Bolster your OSS malware defense: Join Spectra Assure Community (free) ]
What stands out is that the attackers looked past the usual package repositories to the tools developers use to build and manage infrastructure, said Boris Cipot, senior security engineer at Black Duck Software. Terraform users often hold cloud access and sensitive credentials.
“If an attacker manages to compromise the right developer or DevOps environment, they may already be very close to critical infrastructure.”
—Boris Cipot
The malware also stays quiet unless narrow conditions are met, Cipot said, which makes it much harder to find through routine automated testing. Aikido characterized the activity as small and targeted rather than a mass infection campaign.
Brett Smith, a distinguished software developer at SAS, said the Terraform attacks run on patience and secrecy. The malware stays dormant until a specific hash condition is met, and it acts only on messages meant for a given victim. With 18 unique hostnames observed, he said, the operation looks narrowly targeted, and the same gating keeps it out of reach of sandboxes and automated scans.
For Cipot, the evasion is what makes the campaign worth studying. Beyond the conditional activation, Aikido found command-and-control running over both Slack and an Ethereum smart contract.
Smith said DevOps infrastructure has been an under-the-radar security risk for years. DevOps teams do not always follow best practices with secrets, credentials, and API keys, so compromising the IaC can hand an attacker direct access to high-value production credentials.
By targeting workstations with production credentials, the attacker avoids attacking strength and instead strikes weakness. The hardened production environment is skipped in favor of the person who has access to it, he said
“All warfare is based on deception, and a supply chain attack targets trust relationships, so the defender lets the attacker in.”
—Brett Smith
The campaign otherwise resembles familiar attack patterns, though with a new target, Smith said. Porting existing malware to a new language tracks the spread of supply chain attacks beyond npm and PyPI into DevOps tooling, and it fits what known bad actors have been doing to developers for some time.
Rewriting Graphalgo in Go carries other advantages, said Scott Miserendino, chief technology officer at DataBee. Python and JavaScript are interpreted. Go compiles, so the malware can ship as a single binary with no external dependencies and no execution engine or runtime to call.
“There is also less investment in the antivirus space in detection and analysis of Go relative to other more common malware languages, leading to a greater likelihood of evading detection.”
—Scott Miserendino
Darren Meyer, who leads security research at Checkmarx Zero, sees the campaign as part of a broader trend: growing attacker commitment to targeting developers and non-production environments through supply chain compromise. The same tactics used on npm are being repeated in Terraform registries and Go components, he said, which shows that attacks flow to wherever attackers see value and a chance of success rather than staying inside one tech stack or registry.
“And it demonstrates that the industry’s response to supply chain attacks is continuing to do little to stem overall attacker behavior.”
—Darren Meyer
Graphalgo’s move into Terraform providers puts developer-targeted malware next to cloud credentials, said Collin Hogue-Spears, senior director of solution management at Black Duck. “The Graphalgo operators did not need to breach the Terraform Registry; publishing to it was enough,” he said.
The threat actors published two Terraform providers: gocommunity-io/dockerd and kreuzwenker/docker. The kreuzwenker namespace is one letter off from kreunzwerker, the namespace engineers know from a Docker provider with 56 million reported downloads.
Platform teams should route provider installs through an internal mirror that carries only approved providers, using the provider installation block in Terraform’s CLI configuration, Hogue-Spears said, and the same configuration should exclude the public registry from direct installs on build runners. Code reviewers should stop on every new provider source address in a .terraform.lock.hcl diff and confirm the namespace character by character.
“If your build runners resolve any namespace straight from the public registry, you will let a typo in a source address approve itself. A Terraform lock file pins the provider you fetched, not the publisher you meant to trust.”
—Collin Hogue-Spears
What Aikido documented in the Terraform campaign is part of a growing attack vector, Checkmarx’s Meyer said. The pace and number of supply chain attacks aimed primarily at non-production environments keeps rising. Reduced rigor in those environments compared with production environments, combined with the use of AI tools that lower the skill an attacker needs to run and scale these campaigns, has made non-production supply chains an attractive target. “Organizations can no longer delay building security rigor into their development, CI/CD, and other non-production processes and environments,” he warned.
Security teams must treat third-party development dependencies as executable code, said Nevan Beal, principal managed detection-and-response analyst at Blackpoint Cyber. That means visibility into the packages and Terraform providers that developers use, validating where they come from, pinning approved versions, and limiting access to production credentials. Monitoring has to cover developer workstations, CI/CD pipelines, and traditional endpoints alike.
“The real exposure that these threat actors are abusing is the access held by the trusted tools organizations rely on to manage their infrastructure.”
—Nevan Beal
The campaign’s two halves point at the same gap. A Terraform provider and a Go module both arrive as published artifacts, pulled by name from a registry and trusted on the strength of a namespace string. Nothing in that transaction looks at what the artifact actually does.
The Graphalgo operators built their whole approach around that: a dormant payload, a hash-gated trigger, command-and-control hidden in traffic to Slack and a public blockchain, and a namespace that is one character off from a provider with 56 million downloads. Reviewing a lock file diff catches the typo. It does not catch the behavior.
Closing that gap means examining the artifact itself rather than its metadata. Analyzing compiled binaries and fully assembled packages allows for unpacking of nested layers to surface malware, tampering, and exposed secrets before a dependency reaches a build. For teams whose pipelines reach into cloud environments, that check belongs where the artifact enters, not where the incident surfaces.
Learn why ReversingLabs built Spectra Assure Community. Sign up for free today to get started on closing the gap with campaigns such as Graphalgo.
ReversingLabs expanded the published hashes into a staging server, five stagers, two lure files and the domain-to-server links.
New btree malware bypasses the install script, negating the popular repo's measure barely two months after adoption.
This post-mortem on recent supply chain attacks and threat actors including S1ngularity, Shai-Hulud and TeamPCP can help you prepare for what comes next.
