At a Glance Attribute Details Malware Family Graphalgo (Go port) Threat Actor Unknown (suspected Graphalgo campaign operator) Target Victims Cloud architects and DevOps engineers Delivery Vector Typosquatted Terraform providers and poisoned Go modules Key Capabilities Dual C2 (Slack and Arbitrum Sepolia testnet), system discovery, code execution Source Aikido Security (supported by ReversingLabs, Checkmarx, and JFrog) Executive Summary Threat researchers uncovered an attack campaign that weaponized Terraform infrastructure plugins to deliver a Go backdoor.

Cet article présente une analyse technique détaillée d'une extension de la campagne Graphalgo, initialement rapportée par ReversingLabs en février 2026. C'est la première fois que des malwares sont distribués via des providers Terraform.

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.

Lazarus hackers revive the GraphAlgo scam, registering real US LLCs to trick crypto developers into running malware via fake job tests.

Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2.

Aikido Security is an automated application security platform designed specifically for software engineering teams.

Curate Feeds | Make Collections | Customize Email Briefs

セキュリティ研究者らが、2つのTerraformプロバイダーと2つのGoモジュールにGraphalgo関連のマルウェアを発見しました。今回のキャンペーンは、以前npmパッケージで確認された脅威を拡張したもので、通常利用時にはマルウェアを非活性状態に保つ隠しトリガーを使用しています。 Aikido Securityによ

継続中のGraphalgoソフトウェアサプライチェーン攻撃キャンペーンに関連する脅威アクターが、npmおよびPyPIの枠を超えて活動範囲を拡大していることが分かりました。悪意あるTerraformプロバイダーとGoモジュールを使い、Go言語で書かれた標的型リモートアクセス型トロイの木馬(RAT)を配布しています。 今

Malicious Terraform providers and Go modules deliver Graphalgo-linked Go malware using blockchain and Slack for command and control.

Malicious Terraform providers and Go modules deliver Graphalgo-linked Go malware using blockchain and Slack for command and control.

Malicious Terraform providers and Go modules deliver Graphalgo-linked Go malware using blockchain and Slack for command and control.

The graphalgo campaign uses fake job interviews, cloned GitHub organizations, typo‑squatted repositories and crafted GitHub release artifacts to deliver an encrypted multi-stage downloader and a RAT to targeted crypto developers. Evidence including GMT+9 commit timestamps, reused RAT payloads, Git history rewriting and the creation of a Florida LLC indicate a highly organized, likely North Korean state-sponsored operation. #graphalgo #NorthKorea

Malware has moved into tools developers use to build and manage cloud infrastructure. A campaign linked to Graphalgo planted a remote access program in Terraform providers and Go software packages, t…

North Korean threat actors published malicious Terraform providers in the HashiCorp Registry and Go modules on fake sites, extending the Graphalgo campaign from npm and PyPI to a vector closer to production cloud credentials. The discovery, published September 22, 2026 by Aikido, documents a conditi

Infrastructure code has horrifyingly metamorphosed into a convenient snare for developer workstations. Cybersecurity firm Aikido recently unearthed malicious code deeply embedded within dual Terraform providers and twin Go modules. The company classifies this terrifying discovery as the inaugural documented instance of systematic malware distribution weaponizing the official Terraform Registry. The malicious providers, specifically designated as gocommunity-io/dockerd and kreuzwenker/docker, were surreptitiously published in early September.

Researchers uncovered Go-based malware distributed through two Go Modules and two Terraform providers, marking the first known abuse of HashiCorp’s centralized repository as a malware delivery channel. The activity overlaps with Graphalgo and other North Korea-linked campaigns that use fake job offers, npm, PyPI, Slack, and blockchain-based command channels to target...

A new variation of the fake recruiter campaign from North Korean threat actors is targeting JavaScript and Python developers with cryptocurrency-related tasks.

NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.