Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Attackers use malicious Terraform providers and Go modules to distribute Go malware.
Threat actors are leveraging the HashiCorp Registry, distributing Go-based malware through malicious Terraform providers and Go modules. This marks the first known instance of this repository being used as a malware distribution vector. The malware exhibits similarities to the Graphalgo campaign, attributed to North Korean actors, and utilizes dual command-and-control channels via blockchain and Slack.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HashiCorp?
Get an email when a new story names HashiCorp, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors exploited the inherent trust developers place in public package registries by publishing malicious Terraform providers to the HashiCorp Registry, marking a novel supply chain attack vector. The malware, linked to North Korean-attributed actors, embedded dual command-and-control channels via blockchain and Slack to evade traditional network-based detection. This attack highlights the growing risk of typosquatting and malicious package publication in trusted developer ecosystems — a tactic that bypasses perimeter defenses by compromising the software supply chain at the source. Organizations that blindly consume third-party providers without vetting introduce unverified code directly into their infrastructure-as-code pipelines, with potentially catastrophic consequences. The incident underscores that trust in a registry's brand does not equate to trust in every package it hosts.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.