Graphalgo Malware Targets Go Modules and Terraform Providers

Summary

Researchers found Graphalgo-related Go malware in two Terraform providers and two Go modules. The malware uses conditional execution and Slack and blockchain C2; the article details its operation, indicators, and response guidance.

Key points

The malware was found in Terraform providers gocommunity-io/dockerd and kreuzwenker/docker, and Go modules gocommunity[.]io/orderedbtree and gogets[.]dev/btreex.
The Terraform providers activate only when specified input values produce a particular SHA256 hash; Go module variants also use conditional activation.
The providers decrypt an embedded archive and execute its contents as Go code; one Go module conceals its payload in a ZIP archive disguised as a SQL file.
The second-stage Go RAT uses Slack and an Ethereum smart contract on Arbitrum Sepolia for C2, with encrypted, client-specific communications.
Researchers linked the malware to the Graphalgo NPM campaign through shared infrastructure and a public key. The actor also created fake Go package ecosystems to promote malicious packages.
The article recommends isolating affected machines, rotating credentials, reviewing activity, and reimaging systems where the packages ran.

Article Details

Attack Vectors: Malicious Go Modules and Terraform providers distributed Go malware; one provider was a typosquat of a popular Terraform provider.
The provider payload activates only when specified Terraform variable values produce a particular SHA256 hash; the Go Module variant also required specially crafted input.
The malware decrypts files concealed in ZIP archives and executes the resulting Go code. Its second stage can execute additional Go or JavaScript code.
The second-stage agent uses Slack and an Ethereum smart contract on the Arbitrum Sepolia testnet for command and control.
Defensive Notes: Alert on HTTP-based blockchain service communications where there is no business need for blockchain access.
If an affected package or provider ran on a developer machine or CI/CD runner, isolate the environment, rotate credentials that accessed it, review activity during the exposure window, remove the package, and reimage the machine.
For Terraform-provider exposure, prioritize cloud and infrastructure credentials; also review commits, package publishes, Terraform applies, and GitHub Actions runs made from the affected machine or with its credentials.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`gocommunity[.]io`	Fake Go package ecosystem website associated with a threat actor-controlled organization and reportedly used to lend legitimacy to malicious packages.
DOMAIN	`gogets[.]dev`	Fake Go package ecosystem website associated with a threat actor-controlled organization and reportedly used to lend legitimacy to malicious packages.
SHA256	`5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f`	SHA256 of the malicious archive distributed in both Terraform providers.
SHA256	`ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5`	SHA256 of the ZIP archive masquerading as a SQL file in the malicious gogets.dev/btreex Go Module.
URL	`hxxps[:]//portfolio-devs[.]slack[.]com`	Slack workspace used by the malware for C2 check-ins; the article notes the malware communicates with api.slack.com rather than directly contacting this workspace subdomain.
URL	`hxxps[:]//portfolio-testers[.]slack[.]com`	Slack workspace used for subsequent C2 communications; the malware communicates through the Slack API rather than directly contacting this workspace subdomain.