Graphalgo to Terraform/Go: malicious HashiCorp providers + Go modules (Aikido; Slack/blockchain C2)
Aikido (published 22 September 2026; THN 23 Sep) reports Graphalgo-linked Go malware distributed via two Terraform providers (gocommunity-io/dockerd and typosquat kreuzwenker/docker of popular kreuzwerker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) — described as the first use of HashiCorp’s centralized Terraform Registry as a malware distribution vector in this campaign. Providers hide an encrypted ZIP (examples/resources/docker_container/import-resource.sqlite3) decrypted with a SHA-256-derived AES key then executed via detached go run. Implant is a Go port sharing Slack bot + Arbitrum Sepolia smart-contract dead-drop C2 (contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C) with prior npm Graphalgo (ReversingLabs Feb 2026; also Checkmarx/JFrog/SafeDep). Aikido observed plaintext Slack check-ins from 18 unique hostnames (mix of macOS/Linux/Windows). Primary: Aikido; wire: The Hacker News 23 Sep 2026.
- Product
- HashiCorp Terraform Registry providers; Go module proxy (Graphalgo supply-chain malware)
- Versions
- Malicious packages cited by Aikido: Terraform gocommunity-io/dockerd, kreuzwenker/docker (typosquat of kreuzwerker/docker); Go modules gocommunity.io/orderedbtree (from 11 Aug), gogets.dev/btreex (from 8 Sep, forged commit dates). Pin/verify providers; remove if present.
- Exploited in Australia?
- unknown
- Patch to
- Audit Terraform configs for gocommunity-io/dockerd and kreuzwenker/docker; remove and rotate credentials; pin kreuzwerker/docker from a verified source; block gocommunity.io / gogets.dev modules; review Slack/blockchain C2 IoCs in Aikido write-up; treat Contagious Interview / fake Web3 job lures as related access path
Primary: Aikido — Graphalgo malware spreads to Terraform and Go (22 Sep 2026) · Vendor: Aikido Security — Graphalgo Terraform/Go analysis · The Hacker News — malicious Terraform providers via HashiCorp Registry (23 Sep 2026)