HashiCorp Registry Used to Distribute Go Malware via Terraform Providers
North Korean threat actors expand attack vectors with novel Terraform provider exploitation
1Novel attack vector discovered
Security researchers identified Go-based malware distributed through two Terraform providers and Go modules hosted on HashiCorp's centralized registry. This marks the first documented case of threat actors weaponizing HashiCorp's infrastructure for payload delivery. The malware shares infrastructure with Graphalgo, a campaign previously attributed to North Korean operatives. The attack chain demonstrates sophisticated targeting through social engineering on platforms like LinkedIn and fake Web3 job offers.
2Multi-platform delivery mechanism
The campaign employs a multi-pronged approach, distributing malware through npm, PyPI, and now Terraform providers. Analysis reveals the malware only activates when specific cryptographic operations occur, indicating targeted operations. Recent findings show identical malware delivered via malicious npm packages, with some remaining live for just 35 minutes before detection. The operation maintains consistent infrastructure across different distribution channels, including blockchain components and Slack integration.
3Sophisticated C2 architecture
The malware features dual command-and-control channels using blockchain dead drops and Slack bot tokens. It collects comprehensive system information before establishing encrypted communication through ephemeral key pairs. Commands are retrieved from an Ethereum smart contract on Arbitrum Sepolia testnet every 3 seconds. The implementation prevents message leakage between infected hosts, with all clients consuming but only processing messages intended for them through asymmetric cryptography.
4Blockchain-based communication
The malware's C2 mechanism uses a hard-coded Ethereum smart contract address on Arbitrum Sepolia testnet. Commands are encrypted and can execute as either Go or JavaScript code. JFrog researchers noted the payload only decrypts when victims solve specific linear systems with particular matrices. The operation maintains a secondary command channel over Slack, with the malware polling conversations.history endpoint every 10 seconds for instructions.
5Expanding attack surfaces
The Terraform provider tactic represents an evolution from previous npm/PyPI attacks, providing direct access to production credentials. This follows SentinelOne's report of North Korean group TraderTraitor using weaponized Terraform lock files for Rust backdoor delivery. While not conclusively linked, the appearance in separate DPRK-associated campaigns suggests deliberate adoption. Threat actors continue expanding toolsets with techniques reaching diverse targets across software supply chains.
6Parallel loader campaign
CloudSEK identified GHAPPIER JavaScript loader distributed via compromised npm package @dforge-core/dforge-mcp. The malicious version remained active for 35 minutes on September 9, 2026, affecting 65 repositories across 22 accounts. Analysis revealed identical staging hosts but different campaign tags between samples. Some payloads used NullReceiver technique to obtain C2 addresses from attacker wallets, showing overlaps with PolinRider North Korean campaign.
7Rust community targeted
The Rust project warned of ongoing social engineering attacks against crate owners and rust-lang members. Attackers pose as legitimate companies on LinkedIn, initiating video calls to deliver malware disguised as codecs or other utilities. This modus operandi matches the Contagious Interview campaign linked to North Korea. The Rust Foundation advises enabling MFA and monitoring for suspicious account activity amid rising supply chain attacks.
8Security implications
These developments highlight growing sophistication in software supply chain attacks, with threat actors consistently innovating distribution methods. The use of legitimate platforms like HashiCorp Registry and npm demonstrates the challenge of maintaining ecosystem security. Organizations must implement robust software composition analysis and monitor for unusual registry activity. The campaigns underscore North Korean threat actors' adaptability in targeting developer communities across multiple technology stacks.