Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry Ravie LakshmananSep 23, 2026Malware / Supply Chain Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below – gocommunity-io/dockerd (222 downloads) kreuzwenker/docker (1,449 downloads) gocommunity.io/orderedbtree gogets.dev/btreex The malware deployed through these packages demonstrates overlaps with Graphalgo, a campaign that was first documented by ReversingLabs earlier this February and attributed to North Korean (aka DPRK) threat actors. As part of this effort, prospective developers are approached via social platforms like…