Graphalgo Campaign Expands to Terraform Providers and Go Modules
Summary
Aikido researchers report that Graphalgo malware has spread to Terraform providers and Go modules, using conditional activation and Slack and Ethereum-based C2. Experts warn the campaign could expose developer-held cloud credentials.
Key points
- Aikido researchers linked the Terraform and Go activity to the Graphalgo npm campaign previously reported by ReversingLabs.
- The campaign published two Terraform providers: gocommunity-io/dockerd and kreuzwenker/docker; the latter namespace differs by one letter from a known Docker provider namespace.
- The Go malware reportedly remains dormant until a specific hash condition is met and targets messages intended for a particular victim.
- Researchers found command-and-control activity using Slack and an Ethereum smart contract, and observed 18 unique hostnames.
- Aikido characterized the activity as small and targeted, rather than a mass infection campaign.
- Experts recommend routing Terraform provider installs through an internal mirror of approved providers, reviewing source addresses in lock-file changes, and examining dependencies before they enter build pipelines.
Article Details
- Event Type
- Software supply-chain malware campaign expanding into Terraform providers and Go modules
- Impact
- Graphalgo malware was distributed through two published Terraform providers and Go modules, targeting developers and DevOps environments. The campaign could expose production credentials and provide access to cloud infrastructure; Aikido characterized the activity as small and targeted. No breach of the Terraform Registry was required.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gocommunity[.]io | Fake package ecosystem established by the threat actor to make Go packages appear legitimate. |
| DOMAIN | gogets[.]dev | Fake package ecosystem established by the threat actor to make Go packages appear legitimate. |
People
Malware
Vendors
Aikidotasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.HashiCorpBarney, chief information security officer at Keeper Security, interprets the move onto the official HashiCorp Terraform Registry as a deliberate step further upstream in the development lifecycle. While npm package
Products
EthereumFor Cipot, the evasion is what makes the campaign worth studying. Beyond the conditional activation, Aikido found command-and-control running over both Slack and an Ethereum smart contract.npmsecurity researcher Oliver Smith wrote in a September post that the malware overlaps with the Graphalgo npm campaign that ReversingLabs researchers first reported in February.PyPIsaid. Porting existing malware to a new language tracks the spread of supply chain attacks beyond npm and PyPI into DevOps tooling, and it fits what known bad actors have been doing to developers for some time.SlackThe Terraform campaign uses a version of the Graphalgo malware written in Go, and it shares blockchain and Slack infrastructure and a public key with recent JavaScript samples being distributed via npm.TerraformJavaScript and Python developers with cryptocurrency-related fake recruiter tasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.Terraform Registryinformation security officer at Keeper Security, interprets the move onto the official HashiCorp Terraform Registry as a deliberate step further upstream in the development lifecycle. While npm package poisoning