Malicious Terraform Providers and Go Modules Used to Spread North Korea-Linked Malware

Security researchers at Aikido have discovered Go-based malware being distributed through two Go Modules and two Terraform providers hosted on HashiCorp's registry. This marks the first known instance of attackers using this centralised repository as a delivery mechanism for malicious code. The malware shares similarities with a campaign called Graphalgo, previously documented by ReversingLabs and linked to North Korean threat actors.

The attackers reportedly approach developers on platforms like LinkedIn and Facebook, or through fake job postings for non-existent Web3 companies. Victims are asked to complete coding tasks using a GitHub repository that secretly contains a malicious dependency published on npm or PyPI. This discovery coincides with newly identified malicious npm packages delivering the same malware, flagged this week by Checkmarx, JFrog and SafeDep.

The malware is highly targeted: in some cases it only activates when a specific cryptographic condition is met, and it receives instructions from a smart contract on the Ethereum Sepolia testnet as well as a hidden Slack channel. Researchers were able to recover the initial implant but not the follow-up code delivered through these command channels, meaning the full scope of what attackers do once inside a system remains unknown.