Go Malware Campaign Targets Terraform Providers and Go Modules

• •Malware distributed via malicious Terraform providers and Go Modules.
• •Linked to the Graphalgo campaign attributed to North Korean actors.
• •Targets are approached through social platforms and job offers, showcasing a sophisticated attack vector.

Cybersecurity researchers have identified a Go-based malware campaign utilizing malicious Terraform providers and Go Modules. The campaign marks the first known instance of malware being distributed through HashiCorp's centralized repository. The affected packages include gocommunity-io/dockerd and kreuzwenker/docker, with the latter being a typosquat of a popular provider. The malware is linked to the Graphalgo campaign attributed to North Korean threat actors and has been reported to overlap with recent malicious npm packages. The malware activates under specific conditions, utilizing a SHA256 hash to decrypt and execute payloads. It features dual command-and-control channels via blockchain and Slack, gathering system information from infected hosts. The attack has been confirmed by multiple cybersecurity firms, including JFrog and CheckMarx, highlighting its targeted nature and sophisticated delivery methods.