DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform Registry with Malicious Providers and Go Modules to Deliver Go RAT with Slack and Arbitrum Sepolia Blockchain C2
DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform (TL-2026-2635), also tracked as Graphalgo, is a high-severity supply-chain compromise, first published 2026-09-23. It is attributed to Lazarus Group (North Korea) with medium confidence, affects HashiCorp Terraform Registry provider gocommunity-io/dockerd, maps to 19 MITRE ATT&CK techniques (T1027.013, T1033, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2635
- Threat ID
- TL-2026-2635
- Also known as
- Graphalgo, Contagious Interview, PolinRider
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-09-23
- Last reviewed
- 2026-09-23
- Attribution
- Lazarus Group
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, blockchain, cloud infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
North Korea-linked operators behind the Graphalgo fake-recruiter campaign published two malicious Terraform providers (gocommunity-io/dockerd and the kreuzwerker typosquat kreuzwenker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) that drop an environmentally keyed Go remote access trojan, the first documented use of the HashiCorp Terraform Registry as a malware distribution vector. The RAT takes encrypted commands from a smart contract on the Arbitrum Sepolia testnet and from Slack workspaces, and shares its encryption key, infrastructure and tradecraft with a parallel npm wave (mathmain, mathsbase, math-universe and others) and with the PolinRider/NullReceiver cluster.
How DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform works
Aikido Security (Oliver Smith, 22 September 2026) reported that the Graphalgo campaign, first documented by ReversingLabs in February 2026 as a Lazarus Group fake-recruiter operation targeting cryptocurrency and Web3 developers, has spread from npm and PyPI to the HashiCorp Terraform Registry and the Go module ecosystem. Two Terraform providers were published: gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads). The second typosquats the legitimate kreuzwerker/docker provider, which has about 56 million downloads. Two Go modules were also published: gocommunity.io/orderedbtree (11 August 2026) and gogets.dev/btreex (8 September 2026). According to Aikido and The Hacker News, this is the first known use of Terraform providers to distribute malware.
Delivery chain: the providers hide an entry point in /internal/provider/resource_docker_container_funcs.go. It stays dormant unless the SHA-256 hash of the concatenated Terraform variables containerName and networkID equals b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5. That hash is the AES key used to decrypt embedded file paths, so the packages only work for the victims they were built for. This is environmental keying, and the researchers read it as a targeted attack rather than mass compromise. Once triggered, the code unpacks an archive disguised as a SQLite file (examples/resources/docker_container/import-resource.sqlite3 in the providers; btreex.sql in the btreex module). It AES-decrypts each file in the archive and runs the result as a Go package with a detached `go run .` command, so the process outlives the Terraform or Go tooling that started it. To make the packages look mature and trustworthy, the operators stood up two fake Go vanity-import ecosystems, gocommunity.io and gogets.dev, each registered within one day of its GitHub organization. The btreex module also carries forged commits backdated to November 2025. GitHub accounts involved: gocommunity-io, go-pack-tech, kreuzwenker, victormmpp (forged commits), gogets-dev, markcary3, steveb082 and go-community-admin.
Second-stage RAT: the Go implant generates an ephemeral X25519 key pair and derives shared keys by combining it with two threat actor public keys. One of these (302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702) is shared with the Graphalgo npm malware and first appeared in the npm package modern-events in April 2026. The RAT runs two command channels at once. (1) Slack bot C2: it polls the Slack conversations.history API every 10 seconds, checking in on channel frontend-devs in portfolio-devs.slack.com and reading commands from qa-announcements in portfolio-testers.slack.com; mediumstar.slack.com was used earlier. (2) A blockchain dead drop: every 3 seconds it reads the Arbitrum Sepolia testnet contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C through the setCPubKey method and the serviceData1/serviceData2 fields. Each decrypted C2 message has a header that tells the implant to run the body as more Go code, run it as JavaScript through node, or delete itself. Files arrive in start, chunk and end packets that are reassembled on the host. The implant sends reconnaissance to Slack: platform, architecture, hostname, username, home directory, hardware attributes, whether Node.js is available, and a timestamp. Aikido counted 1,240 encrypted Slack messages and 1,402 contract transactions since testing began on 16 July 2026 (a Windows host named "Frank"). Across 725 messages it found 18 unique victim hostnames: 3 Windows, 5 Linux and 10 macOS.
Related npm wave and cluster overlap: in parallel, JFrog, SafeDep, Checkmarx and Socket flagged npm packages built the same way, including indexed-btree, mathsbase, mathmain, math-universe, modern-events, quick-events, crypto-hasher, events-router, sort-btree, graphcore-js and graphlib-js. SafeDep counted 24 packages and 60+ malicious versions between March and September 2026, with download counts inflated by a farm of GitHub Actions workers. In that wave the loader only decrypts when the caller passes the Pascal matrix [[1,1,1],[1,2,3],[1,3,6]] to lusolve(). The JSON-serialized lower-triangular LU factor becomes the scrypt password for AES-256-GCM decryption. The decrypted stage spawns detached Node.js children, polls Slack every 10 seconds, and reads Base Sepolia and Ethereum Sepolia contracts (0xac0bfC4C48A679b667732128278EACBA1c191894, 0xE390863Dac96a7118C71227C2b099B50cF602D31) through Infura and Alchemy RPC endpoints. A second payload uses the NullReceiver technique to resolve its C2 address, 193.247.144.38, from an attacker wallet, and ends with the byte sequence 68656c6c6f6970626f742121 ("helloipbot!!"). Both are shared with the long-running DPRK-linked PolinRider campaign; Socket lists 193.247.144.38 as PolinRider C2. The Hacker News also cites overlaps with Contagious Interview, a CloudSEK-reported GHAPPIER npm loader (version 0.2.21, live for 35 minutes 38 seconds on 9 September 2026) that uses the same staging host and Vercel domain request, and a SentinelOne report on TraderTraitor using weaponized Terraform lock files and custom provider registries to deliver Rust backdoors.
The initial lure follows Graphalgo's established pattern. Developers are approached on LinkedIn, Facebook or Reddit by fake Web3 companies (for example Veltrix Capital) and given a benign-looking coding task whose dependency pulls in the malicious package. On 17 September 2026 the Rust Foundation warned that these actors set up legitimate-looking company profiles with plausible LinkedIn presences. Remediation guidance from Aikido: isolate affected hosts, because C2 persists over the Slack API and the smart contract; rotate all Go, GitHub/GitLab, npm/PyPI publish, cloud and SSH credentials; audit activity during the exposure window; and reimage, because the detached `go run .` process survives removal of the package.
MITRE ATT&CK techniques used in TL-2026-2635
Stealth
T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1036.008 Masquerading: Masquerade File Type; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480.001 Execution Guardrails: Environmental Keying
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Execution
T1059.007 Command and Scripting Interpreter: JavaScript; T1204.005 User Execution: Malicious Library
Command and Control
T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.003 Phishing: Spearphishing via Service
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services; T1585 Establish Accounts; T1608.001 Stage Capabilities: Upload Malware
Affected products and versions in DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform
- HashiCorp — Terraform Registry provider gocommunity-io/dockerd
Vulnerable versions: all published versions - HashiCorp — Terraform Registry provider kreuzwenker/docker (typosquat of kreuzwerker/docker)
Vulnerable versions: all published versions - Go module ecosystem — gocommunity.io/orderedbtree
Vulnerable versions: all published versions - Go module ecosystem — gogets.dev/btreex
Vulnerable versions: all published versions - npm — mathmain / mathsbase / math-universe / modern-events / graphcore-js / graphlib-js and related packages
Vulnerable versions: mathmain 1.0.0; mathsbase 1.0.1; math-universe 1.0.0-1.0.2; modern-events 1.3.3-1.5.2; graphcore-js 2.3.2, 2.3.4, 2.4.1, 2.4.2; graphlib-js 1.2.0-1.3.4
Remediation for DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform
Immediate actions
- Search Terraform lock files (.terraform.lock.hcl), provider caches and go.mod/go.sum for gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex and remove them
- Isolate any host that ran the packages; C2 persists over the Slack API and the Arbitrum Sepolia smart contract even after the package is removed
- Hunt for detached 'go run .' processes and for unexpected node child processes started from Terraform, Go or npm working directories
- Block or alert on egress to 193.247.144.38 and on non-sanctioned Slack workspaces portfolio-devs.slack.com, portfolio-testers.slack.com and mediumstar.slack.com
- Remove the related npm packages (mathmain, mathsbase, math-universe, modern-events, quick-events, indexed-btree, crypto-hasher, events-router, sort-btree, graphcore-js, graphlib-js)
Workarounds
- Rotate every credential exposed on affected machines: Go tokens, GitHub/GitLab tokens, npm/PyPI/Go publish tokens, cloud provider credentials and SSH keys
- Reimage affected systems rather than just uninstalling the package
- Audit repositories and cloud accounts for unauthorized activity during the exposure window
Longer-term hardening
- Pin Terraform providers to verified namespaces (for example kreuzwerker/docker) and review provider source addresses for typosquats
- Proxy Go modules through a vetted GOPROXY/allowlist and reject unknown vanity import domains
- Monitor developer endpoints for access to blockchain RPC providers (Infura, Alchemy, Arbitrum/Base/Ethereum Sepolia) from non-Web3 tooling
- Train developers on fake-recruiter coding-task lures and require take-home assignments to run in disposable sandboxes
Weaknesses (CWE) in DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform
CWE-506
Timeline of DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform
- Graphalgo fake-recruiter campaign starts in early May 2025 with the first malicious npm package, 'graphalgo', aimed at JavaScript and Python crypto developers (ReversingLabs)
- ReversingLabs documents Graphalgo, attributes it to Lazarus Group and reports the malicious bigmathutils 1.1.0 and the Veltrix Capital fake-company lure
- The threat actor X25519 public key later embedded in the Go RAT first appears in the npm package modern-events (April 2026)
- Initial malware testing seen from a Windows host named 'Frank'; start of the 1,240 encrypted Slack C2 messages Aikido analyzed
- First transaction to the Arbitrum Sepolia C2 smart contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C (1,402 transactions in total)
- Malicious Go module gocommunity.io/orderedbtree published through the fake gocommunity.io vanity-import ecosystem
- Malicious Go module gogets.dev/btreex published with forged commits backdated to November 2025; the Terraform providers gocommunity-io/dockerd and kreuzwenker/docker appear on the HashiCorp registry in early September
- Related GHAPPIER npm loader v0.2.21 (CloudSEK) is live for 35 minutes 38 seconds, using the same staging host and Vercel domain request
- Socket reports PolinRider (C2 193.247.144.38, NullReceiver dead drops); the Rust Foundation warns of fake-company job-interview lures
- SafeDep publishes its analysis of the mathmain/mathsbase/math-universe encrypted loader keyed on a Pascal-matrix lusolve() input with Sepolia and Slack C2
- Aikido Security publishes 'Graphalgo Malware Spreads to Terraform and Go', the first documented malware distribution through the HashiCorp Terraform Registry
- The Hacker News and others report the campaign and its overlaps with Contagious Interview, PolinRider and TraderTraitor
Sources cited for DPRK-Linked Graphalgo Campaign Abuses HashiCorp Terraform
- Graphalgo Malware Spreads to Terraform and Go
- Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
- Why Does an npm Math Library Need an Encrypted Loader?
- PolinRider Spreads Through Compromised GitHub Accounts and Packagist
- Fake recruiter campaign targets crypto developers with RAT (Graphalgo)
- Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT
- Graphalgo Terraform Malware Targets Cloud Credentials
- Graphalgo Malware Hits Terraform and Go Packages in New Supply Chain Attack
More in supply chain
- Re-Enabled actions-cool GitHub Actions (issues-helper, maintain-one-comment) Resume Executing Mini Shai-Hulud CI/CD Credential-Theft Payload
- Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
- Adform Ad-Tech Platform Compromised: Trojanized Tracking Script Serves Crypto Clipboard Stealer via Supply-Chain Attack
- GHAPPIER Loader: npm Trusted-Publishing Abuse Compromises @dforge-core/dforge-mcp
- Rust Team Members and Popular Crate Owners Targeted via Fake Job Video Calls (North Korea-Linked)
Detection coverage for TL-2026-2635
As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2635 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2635
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.