Malicious Terraform Providers and Go Modules Deliver Go Malware in Developer-Targeting Campaign
Summary
Researchers found Go malware distributed through malicious Terraform providers and Go Modules, with Slack and blockchain C2. The activity overlaps with DPRK-linked campaigns using fake developer job offers; the operators’ later actions remain unknown.
Key points
- Researchers reported malicious Go packages distributed through two Go Modules and two Terraform providers, describing this as the first known abuse of HashiCorp’s centralized repository for malware delivery.
- The Go malware shares blockchain and Slack infrastructure with a related npm version and collects host and system information.
- The implant polls Slack and Ethereum smart contracts for encrypted commands that can execute Go or JavaScript code.
- Researchers recovered the implant but not the later code delivered through its command channels, so the operators’ actions on victims are unknown.
- The activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake Web3 job offers and coding tasks to target developers.
- Separately, researchers reported a compromised npm package distributing a loader and warned of related job-interview lures; the Rust project advised contributors to enable MFA and review accounts for unexpected logins.
Article Details
- Attack Vectors
- Malicious Go Modules and Terraform providers distributed Go malware through package registries.
- Fake Web3 job offers and developer interviews on social platforms and forums lured targets into coding tasks that introduced malicious dependencies through npm or PyPI.
- A compromised npm package, @dforge-core/dforge-mcp version 0.2.21, distributed the GHAPPIER JavaScript loader; the operator reportedly used stolen developer credentials to write to repositories accessible to the developer.
- Fake video calls and job or project opportunities were used to persuade targets to install purportedly missing software or execute commands, including commands placed on the clipboard.
- Defensive Notes
- The Rust project urged contributors and crate owners to enable multi-factor authentication and check accounts for unexpected logins.
- Researchers could not determine the later tasks run by operators because the code delivered through the command channels was not recovered.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]247[.]144[.]38 | C2 address obtained from an attacker wallet by the second GHAPPIER payload using the NullReceiver technique. |
MITRE ATT&CK
T1059 · Command and Scripting InterpreterThe implant executed operator-supplied commands as Go or JavaScript code.T1071.001 · Web ProtocolsThe implant contacted a Slack channel through the API and polled the conversations.history endpoint for commands.T1082 · System Information DiscoveryThe malware collected system information including hardware attributes, operating system, and hostname.T1112 · Modify RegistryThe GHAPPIER loader fetched operator-controlled code and ran it, allowing payloads to be changed at runtime.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious packages and Terraform providers introduced payloads through software supply-chain distribution.T1555 · Credentials from Password StoresThe article reports that operators obtained developers' stored credentials and used them to write to repositories they could access.T1566.003 · Spearphishing via ServiceOperators used fake job and project opportunities, including developer interviews, to lure targets.
People
Adam HarveyRust Foundation software developer who described interview lures used to prompt targets to install software or execute commands.Karlo ZankiSocket security researcher who commented on the campaign's interview-based initial access and execution gating.Oliver SmithSecurity researcher who described the malware's ephemeral key generation and shared-key communications.Vikas KunduCloudSEK researcher who reported that operators used developers' stored credentials to write to their repositories.
Threat Actors
Malware
Vendors
Products
Go modulesResearchers uncovered Go-based malware distributed through two Go Modules and two Terraform providers, marking the first known abuse of HashiCorp’s centralized repository as a malware delivery channel.Node.js“The blockchain path also decrypts remote data, writes subwatcher, and starts it with Node.js,” SafeDep said.npmThe activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake job offers, npm, PyPI, Slack, and blockchain-based command channels to target developers and distribute payloads.PyPIThe activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake job offers, npm, PyPI, Slack, and blockchain-based command channels to target developers and distribute payloads.SlackThe activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake job offers, npm, PyPI, Slack, and blockchain-based command channels to target developers and distribute payloads.TerraformResearchers uncovered Go-based malware distributed through two Go Modules and two Terraform providers, marking the first known abuse of HashiCorp’s centralized repository as a malware delivery channel.