INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Attackers Use Malicious Terraform Providers to Deliver Go Malware

| 2026-09-23 19:55 CRITICAL HIGH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
Attackers used malicious Terraform providers to deliver Go malware via the HashiCorp Registry on September 23, 2026. North Korea is believed to be behind this attack, which overlaps with a long-running campaign known as PolinRider. The affected entities include individuals and organizations that use these compromised packages in their projects, although no specific numbers are provided. The attackers exploit vulnerabilities by using the malicious Terraform providers to distribute Go malware via two modules and two Terraform providers hosted on HashiCorp's registry. This attack works by tricking users into installing the infected packages, which then execute a payload that decrypts only when a specific cryptographic operation is performed or when a file transfer occurs. The current status of this incident is ongoing, with researchers continuing to analyze the malware and its distribution channels.
Technical Mitigations AI-generated
• indexed-btree • crypto-hasher • graphalgo • mathmain
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 5 IoCs Create Free Account
sa•••••.io
co•••••.history
No•••••.js
193.247.•••.•••
hxxp://••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Contagious InterviewContagious Interview
Target & Sectors
DPRK DPRK technologytechnology cryptocurrencycryptocurrency
Incident Timeline
‎September 9, 2026
Threat actors used a malicious Terraform provider to deliver Go malware via the HashiCorp Registry, which remained live for 35 minutes and 38 seconds on September 9, 2026.
infrastructure 0.2.21
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
infrastructure 0.2.22
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
general_metric 35 minutes
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
general_metric 38 seconds
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
‎2026/09/16
Threat actors used malicious Terraform providers to deliver Go malware via HashiCorp Registry.
organisation SentinelOne
In a report published last week, SentinelOne detailed how the threat activity cluster codenamed TraderTraitor relied on weaponized Terraform lock files to facilitate the delivery of Rust-based backdoors from custom Terraform provider registries controlled by the attackers.
organisation TraderTraitor
In a report published last week, SentinelOne detailed how the threat activity cluster codenamed TraderTraitor relied on weaponized Terraform lock files to facilitate the delivery of Rust-based backdoors from custom Terraform provider registries controlled by the attackers.
‎2026/09/23
Threat actors used malicious Terraform providers to deliver Go malware via HashiCorp Registry.
organisation HashiCorp Registry
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry.
threat_actor Contagious Interview
" The Rust project said the modus operandi overlaps with the Contagious Interview campaign tied to North Korea , urging contributors and crate owners to exercise caution, ensure multi-factor authentication (MFA) is enabled, and check their accounts for unexpected logins.
organisation MFA
" The Rust project said the modus operandi overlaps with the Contagious Interview campaign tied to North Korea , urging contributors and crate owners to exercise caution, ensure multi-factor authentication (MFA) is enabled, and check their accounts for unexpected logins.
organisation ReversingLabs
According to Aikido , the list of Terraform providers and Go modules is below - The malware deployed through these packages demonstrates overlaps with Graphalgo , a campaign that was first documented by ReversingLabs earlier this February and attributed to North Korean (aka DPRK) threat actors.
organisation Node.js
…ant is also designed to contact a Slack channel and polls the " conversations.history " endpoint every 10 seconds and performs the next action based on the packet type - Start packet, to begin a file transfer Chunk packet, to supply file content End packet, to join the chunks "The blockchain path also decrypts remote data, writes subwatcher, and starts it with Node.js," SafeDep said.
organisation Terraform
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.
organisation HashiCorp
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads.
organisation PyPI
As part of this effort, prospective developers are approached via social platforms like LinkedIn and Facebook, or through job offerings on forums by posing as non-existent Web3 companies, and then asked to complete a coding task by providing a benign GitHub repository that introduces the malicious behavior via a dependency published on npm or PyPI.
organisation SafeDep
A list of some of the flagged packages, as highlighted by Checkmarx , JFrog , and SafeDep , is as follows - indexed-btree mathsbase mathmain math-universe modern-events quick-events crypto-hasher events-router sort-btree graphcore-js graphlib-js An analysis of these packages shows that, in some cases, the malware execution is triggered only when a specific cryptogr…
organisation graphlib
…ckmarx , JFrog , and SafeDep , is as follows - indexed-btree mathsbase mathmain math-universe modern-events quick-events crypto-hasher events-router sort-btree graphcore-js graphlib-js An analysis of these packages shows that, in some cases, the malware execution is triggered only when a specific cryptographic operation is performed, exhibiting all hallmarks of a ta…
organisation Ethereum Sepolia
"The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog said.
organisation Slack
"The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog said.
organisation GitHub Actions
"The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog said.
organisation JFrog
"The payload decrypts only when the victim solves a linear system with one specific matrix, takes its orders from a smart contract on the Ethereum Sepolia testnet, keeps a second command channel open over Slack, and hides behind download counts manufactured by a farm of GitHub Actions workers," JFrog said.
organisation Aikido
" Aikido said the malware distributed through the Terraform providers and Go Modules is a Go port that shares blockchain and Slack infrastructure with the npm version.
organisation API
The captured data is then transmitted to the attacker-controlled Slack channel over the API.
organisation Ethereum
" The blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address, using it to poll for encrypted commands every three seconds.
organisation Arbitrum Sepolia
" The blockchain-based C2 retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using a hard-coded contract address, using it to poll for encrypted commands every three seconds.
organisation Malicious npm Package
" Malicious npm Package Shares Links to PolinRider The development comes as CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER that was distributed following the compromise of a legitimate npm package, "@dforge-core/dforge-mcp."
organisation CloudSEK
" Malicious npm Package Shares Links to PolinRider The development comes as CloudSEK highlighted a previously unreported JavaScript loader named GHAPPIER that was distributed following the compromise of a legitimate npm package, "@dforge-core/dforge-mcp."
organisation The Hacker News
Socket security researcher Karlo Zanki told The Hacker News that Graphalgo continues to stick to the same operational playbook, likely using fake job interviews as the primary initial access vector.
organisation Is Terraform Registry
" Is Terraform Registry the New Supply Chain Attack Vector?
organisation NullReceiver
Interestingly, the second payload has been observed using the NullReceiver technique to obtain its C2 address ("193.247.144[.]38") from an attacker wallet and features the same trailing byte sequence ("68656c6c6f6970626f742121") that decodes to the string "helloipbot!!."
organisation Rust Warns of Job Interviews
Rust Warns of Job Interviews with a Malicious Payload The findings also follow a warning from the Rust project about an ongoing campaign targeting rust-lang members and owners of popular crates with the goal of compromising their devices and accounts for malware distribution.
organisation Rust
Rust Warns of Job Interviews with a Malicious Payload The findings also follow a warning from the Rust project about an ongoing campaign targeting rust-lang members and owners of popular crates with the goal of compromising their devices and accounts for malware distribution.
organisation the Rust Foundation
…is set up for something positive – maybe for a job, maybe for a project, maybe for a contract opportunity – and then that's used as a vector to either get the target to install something on their computer (such as a purportedly missing audio codec) or execute another command (for example, via putting a command on the clipboard)," Adam Harvey, a software developer at the Rust Foundation, said .
organisation LinkedIn
"These attackers are setting up new but legitimate-seeming company profiles, including plausible LinkedIn presences, in order to pass cursory inspection.
Tactical Metrics
Metrics
infrastructure
‎0.2.21
Software Version
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
Metrics
infrastructure
‎0.2.22
Software Version
The malicious version (0.2.21) is said to have remained live on npm for 35 minutes and 38 seconds on September 9, 2026, before the original maintainer reverted the changes and published a clean version (0.2.22).
Intelligence Sources
The Hacker News 2026-09-23
AlienVault OTX 2026-09-23