Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Threat actors, attributed to North Korea, are distributing Go-based malware through malicious Terraform providers and Go modules hosted on the HashiCorp and npm registries, marking a novel supply chain attack vector. The malware uses dual command-and-control channels via Ethereum smart contracts on testnets and Slack, with execution often gated by cryptographic checks to hinder analysis. The same infrastructure and techniques are linked to the previously known Graphalgo and PolinRider campaigns, indicating a coordinated, targeted operation using fake job interviews as an initial access vector.

AI-extracted · verify before operational use