Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/

Researchers reported that attackers distributed Go-based malware through two malicious Terraform providers and two Go modules hosted in public registries, including HashiCorp’s Terraform Registry.[1][15] The packages contained hidden activation logic and the malware used blockchain and Slack infrastructure for command and control.[1][15] RealGround analysis: compromised infrastructure dependencies can affect AI systems and agent environments that rely on Terraform or Go packages, creating a significant software supply-chain risk; organizations should inventory dependencies, validate provider provenance, and monitor registry-sourced components.