Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | Graphalgo (Go port) |
| Threat Actor | Unknown (suspected Graphalgo campaign operator) |
| Target Victims | Cloud architects and DevOps engineers |
| Delivery Vector | Typosquatted Terraform providers and poisoned Go modules |
| Key Capabilities | Dual C2 (Slack and Arbitrum Sepolia testnet), system discovery, code execution |
| Source | Aikido Security (supported by ReversingLabs, Checkmarx, and JFrog) |
Executive Summary
Threat researchers uncovered an attack campaign that weaponized Terraform infrastructure plugins to deliver a Go backdoor. Attackers targeted cloud developers by creating typosquatted packages and establishing dual command channels on Slack and Ethereum testnets. Telemetry confirms that the intrusion set compromises Windows, Linux, and macOS endpoints.
Delivery Tactics and Typosquatting
The campaign relies on typosquatting popular open-source cloud components. In early September, the threat actor published two fraudulent plugins named gocommunity-io/dockerd and kreuzwenker/docker. The latter clones the popular kreuzwerker/docker utility, which boasts 56 million legitimate downloads. Furthermore, the attacker distributed two poisoned Go modules under the names gocommunity.io/orderedbtree and gogets.dev/btreex.
To support the scheme, the operator built two fake package portals named gogets.dev and gocommunity.io. These portals mimic vanity package managers to deceive programmers. Additionally, the adversary backdated Git commits to November 2025 to make the malicious repositories appear mature. By targeting DevOps engineers, the attacker seeks direct access to sensitive cloud production credentials.
Infection Chain Architecture
The malicious providers remain inert during normal development tasks. Specifically, the malicious code activates only when developers pass specific target container names and network values. As Aikido Security reported, “Both providers contain hidden entry points in the /internal/provider/resource_docker_container_funcs.go file that activate only when the SHA256 hash of the containerName and networkID Terraform variables concatenated together is b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5.”
Once matched, the script uses that specific hash as an AES key. The malware then unpacks an embedded archive disguised as a database file. Next, it decrypts the contained Go files and executes the second-stage payload as a detached background process. Similarly, the Go module variants require specific inputs before decrypting their inner archives.
Command-and-Control and Data Exfiltration
The second-stage payload operates as a remote access trojan written in Go. Upon launch, it gathers operating system details, user account names, and local Node.js installations. Next, the trojan sends this initial discovery report to an attacker-controlled Slack workspace.
Then, the malware configures dual command-and-control channels across Slack and the Arbitrum Sepolia Ethereum testnet. It generates ephemeral cryptographic keys to encrypt communications between infected endpoints and the operator. The implant reads tasking from the blockchain smart contract and executes arbitrary Go or JavaScript commands.
Aikido noted, “Plaintext check-in messages in the threat actor’s Slack channel contain 18 unique hostnames over 725 messages.” Sourced telemetry indicates that the victims include ten macOS systems, five Linux machines, and three Windows devices.
Attribution Analysis
Security analysts assess with moderate confidence that the adversary shares links with the Graphalgo intrusion cluster. ReversingLabs first documented Graphalgo targeting JavaScript packages on npm in February 2026. Corroborating reports from Checkmarx and JFrog confirmed identical public keys across both campaigns. However, formal attribution to a specific threat group remains unconfirmed.
Defense and Detection Guidance
Security teams must inspect their development pipelines to detect malicious Terraform providers. Organizations should pin trusted provider namespaces and verify source repository URLs before running automated deployments. Furthermore, administrators should monitor developer workstations for unusual outbound traffic to public blockchain RPC nodes and unexpected Slack workspaces.
Teams can review detailed technical indicators in the Aikido report on malicious Terraform providers and Go modules. Blocking untrusted Go package mirrors will help protect build systems from supply chain tampering.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
