Skip to content
Go Malware Campaign Targets Terraform Providers and Go Modules

Go Malware Campaign Targets Terraform Providers and Go Modules

First seen 23 Sep 2026, 19:54 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 23, 2026 at 20:58 UTC
  • •Malware distributed via malicious Terraform providers and Go Modules.
  • •Linked to the Graphalgo campaign attributed to North Korean actors.
  • •Targets are approached through social platforms and job offers, showcasing a sophisticated attack vector.

Cybersecurity researchers have identified a Go-based malware campaign utilizing malicious Terraform providers and Go Modules. The campaign marks the first known instance of malware being distributed through HashiCorp's centralized repository. The affected packages include gocommunity-io/dockerd and kreuzwenker/docker, with the latter being a typosquat of a popular provider. The malware is linked to the Graphalgo campaign attributed to North Korean threat actors and has been reported to overlap with recent malicious npm packages. The malware activates under specific conditions, utilizing a SHA256 hash to decrypt and execute payloads. It features dual command-and-control channels via blockchain and Slack, gathering system information from infected hosts. The attack has been confirmed by multiple cybersecurity firms, including JFrog and CheckMarx, highlighting its targeted nature and sophisticated delivery methods.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-02-01
Graphalgo campaign first reported
ReversingLabs documented the Graphalgo malware campaign attributed to North Korean threat actors.
Aikido.Dev
2026-09-01
Malicious Terraform providers published
Threat actors published gocommunity-io/dockerd and kreuzwenker/docker Terraform providers, with hidden malware.
Aikido.Dev
2026-09-22
Malware discovery reported
Aikido reported the discovery of Go malware distributed via Terraform providers and Go Modules.
Aikido.Dev
2026-09-23
The Hacker News reports on malware
The Hacker News published details on the Go malware campaign, confirming its distribution methods and targets.
Thehackernews

More articles in this cluster (2)

Following this threat?

Track TraderTraitor and Arbitrum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (34)

1 / 4