North Korean Hackers Use HashiCorp Registry to Spread Go Malware via Terraform Providers

September 23, 2026 at 11:06 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Cybersecurity researchers disclosed Go-based malware distributed through two Terraform providers and two Go modules on HashiCorp's registry, marking the first use of the platform for malicious payload delivery. The malware overlaps with the Graphalgo campaign attributed to North Korean threat actors. The attack chain uses encrypted payloads and command channels over Slack and Ethereum Sepolia testnet.

Key Facts

Two Terraform providers and two Go modules on HashiCorp's registry were used to distribute Go-based malware, with download counts of 222 and 1,449 respectively.
The malware overlaps with the Graphalgo campaign, first documented by ReversingLabs in February 2026 and attributed to North Korean threat actors.
Attackers approached developers via LinkedIn, Facebook, and job forums posing as non-existent Web3 companies, asking them to complete coding tasks using malicious dependencies.
New malicious npm packages delivering the same malware were identified this week by Checkmarx, JFrog, and SafeDep, including indexed-btree, mathsbase, and graphcore-js.
The implant contacts a Slack channel every 10 seconds and uses a smart contract on Ethereum Sepolia testnet for command and control.

Malicious Package Distribution

Aikido identified the Terraform providers gocommunity-io/dockerd and kreuzwenker/docker, along with Go modules gocommunity.io/orderedbtree and gogets.dev/btreex, as distribution vectors. The providers had 222 and 1,449 downloads respectively, indicating active use by developers. This marks the first time threat actors have used HashiCorp's centralized repository to deliver malicious payloads. The malware deployed through these packages shows overlaps with the Graphalgo campaign attributed to North Korean actors.

Attack Chain and Infrastructure

The payload decrypts only when the victim solves a linear system with a specific matrix, according to JFrog. The implant takes orders from a smart contract on the Ethereum Sepolia testnet and keeps a second command channel open over Slack. It polls the Slack conversations.history endpoint every 10 seconds and performs actions based on packet type: Start, Chunk, or End. SafeDep reported that the blockchain path decrypts remote data, writes a subwatcher, and starts it with Node.js. The exact functions of the encrypted payload remain unknown because it is encrypted with asymmetric cryptography.

Social Engineering and npm Packages

Prospective developers were approached via LinkedIn, Facebook, and job forums by attackers posing as non-existent Web3 companies. They were asked to complete coding tasks by providing a benign GitHub repository that introduced malicious behavior via a dependency published on npm or PyPI. This week, Checkmarx, JFrog, and SafeDep identified new malicious npm packages delivering the same malware, including indexed-btree, mathsbase, and graphcore-js. In some cases, malware execution is triggered only when a specific cryptographic operation is performed, indicating a targeted operation.