Threat reportSupply ChainTL-2026-4328
Graphalgo Campaign Expands Upstream into Infrastructure as Code via Malicious Terraform Providers and Go Modules
Graphalgo Campaign Expands Upstream into Infrastructure as (TL-2026-4328), also tracked as Graphalgo, is a high-severity supply-chain compromise, first published 2026-10-24. It is attributed to Graphalgo operators (North Korea) with medium confidence, affects HashiCorp Terraform Registry providers, maps to 15 MITRE ATT&CK techniques (T1027, T1036.005, T1059), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Graphalgo operators
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-4328
- Threat ID
- TL-2026-4328
- Also known as
- Graphalgo, Graphalgo Terraform/Go expansion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- Graphalgo operators
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, cloud and devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Graphalgo Campaign Expands Upstream into Infrastructure as
Malware and tooling: Graphalgo
How Graphalgo Campaign Expands Upstream into Infrastructure as works
The DPRK-linked Graphalgo campaign, previously seen distributing malicious npm and PyPI packages through fake recruiter coding tasks, has expanded to the HashiCorp Terraform Registry and the Go module ecosystem. Two malicious Terraform providers (one typosquatting the 56M-download kreuzwerker/docker provider) and two Go modules deliver a hash-gated Go RAT that uses an Arbitrum Sepolia smart contract and Slack as dual C2 channels.
Aikido Security (published around 2026-09-23) and ReversingLabs (blog 2026-10-21) describe a Go port of the Graphalgo malware delivered through two Terraform providers, gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), and two Go modules, gocommunity.io/orderedbtree (published 2026-08-11) and gogets.dev/btreex (published 2026-09-08). kreuzwenker/docker typosquats the legitimate kreuzwerker/docker provider, which has about 56 million downloads. Aikido describes this as the first confirmed use of the Terraform Registry as a malware distribution vector. Because Terraform providers execute during provisioning, often on hosts that already hold cloud credentials, source access and deployment secrets, the blast radius extends from a single application to the underlying cloud environment.
The malware is hash-gated. In the Terraform providers it activates only when the SHA256 of the concatenated containerName and networkID equals b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5. That value doubles as an AES key that decrypts the payload file paths and payloads, so sandboxes and automated scans never see the payload. The payload is staged in examples/resources/docker_container/import-resource.sqlite3 (providers) and btreex.sql (Go module). In gogets.dev/btreex the gate requires a specific price integer value in processed objects. THN reports that the payload decrypts only when the victim solves a linear system with a specific matrix.
The second-stage RAT collects OS, architecture, hostname, username, home directory, Node.js availability and current time, and reports them to Slack. It runs two C2 channels. The first is a blockchain dead drop on the Arbitrum Sepolia testnet: smart contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C is polled every 3 seconds, and the implant registers an ephemeral public key through the setCPubKey method. The second is a Slack bot token: check-ins go to the frontend-devs channel in portfolio-devs.slack.com, and commands arrive from the qa-announcements channel in portfolio-testers.slack.com, polled through conversations.history every 10 seconds. Traffic is encrypted per victim with asymmetric cryptography. Commands run as Go or JavaScript code through node, or trigger self-deletion, and file transfer uses Start/Chunk/End packet types. The actor public key is shared with recent JavaScript samples, first seen in the npm package modern-events in April 2026.
Aikido recorded 18 unique victim hostnames (3 Windows, 5 Linux, 10 macOS), 725 plaintext check-in messages, 1,240 encrypted Slack messages since 2026-07-16 and 1,402 blockchain transactions since 2026-08-06. Testing began on 2026-07-16 from a host named Frank (user Frank1). The actor registered the fake ecosystem domains gocommunity.io and gogets.dev within one day of creating the matching GitHub organizations, and used forged commits and multiple committer accounts to make the repositories look legitimate.
The original Graphalgo campaign, documented by ReversingLabs in February 2026, used a fake blockchain firm (Veltrix Capital) and recruiter coding tasks whose repositories pulled in malicious npm and PyPI dependencies such as bigmathutils and graphnetworkx. The ReversingLabs IaC post describes the current operation as small and targeted. THN reports links to North Korean clusters (TraderTraitor, Contagious Interview, PolinRider). ReversingLabs' own post does not name an actor, so attribution is rated MEDIUM.
MITRE ATT&CK techniques used in TL-2026-4328
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1480.001 Environmental Keying
Execution
T1059 Command and Scripting Interpreter; T1059.007 JavaScript
Discovery
T1082 System Information Discovery
Command and Control
T1102.001 Dead Drop Resolver; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service
Resource Development
Affected products and versions in Graphalgo Campaign Expands Upstream into Infrastructure as
- HashiCorp — Terraform Registry providers
Vulnerable versions: gocommunity-io/dockerd; kreuzwenker/docker - Go ecosystem — Go modules
Vulnerable versions: gocommunity.io/orderedbtree; gogets.dev/btreex - npm — npm packages
Vulnerable versions: indexed-btree; mathsbase; mathmain; math-universe; modern-events; quick-events; crypto-hasher; events-router; sort-btree; graphcore-js
Remediation for Graphalgo Campaign Expands Upstream into Infrastructure as
Immediate actions
- Search lock files, go.sum/go.mod and build logs for gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree and gogets.dev/btreex
- Isolate any host that installed these packages and reimage it rather than just removing the package
- Rotate Git tokens, cloud provider credentials and SSH keys exposed to affected hosts or CI runners
- Block or alert on portfolio-devs.slack.com, portfolio-testers.slack.com and mediumstar.slack.com from developer and CI hosts where Slack is not needed
- Review activity during the exposure window for unauthorized access
Workarounds
- Use the verified kreuzwerker/docker provider namespace only; remove unapproved providers and modules from registries and caches
Longer-term hardening
- Route Terraform provider installs through an internal mirror with an approved-only policy and exclude direct public registry access from build runners
- Pin providers in .terraform.lock.hcl and review provider namespaces character by character in lock file diffs
- Treat third-party dependencies as executable code and validate artifact behavior, not just metadata
- Limit production credentials available in non-production and CI environments
- Verify the legitimacy of recruiters and employers before running coding tasks
Weaknesses (CWE) in Graphalgo Campaign Expands Upstream into Infrastructure as
Timeline of Graphalgo Campaign Expands Upstream into Infrastructure as
- ReversingLabs publicly documents the Graphalgo fake-recruiter campaign distributing malicious npm and PyPI packages (e.g., bigmathutils) to cryptocurrency and JavaScript/Python developers.
- The actor public key later found in the Go samples first appears in the npm package modern-events (April 2026), linking the later activity to Graphalgo.
- Slack C2 testing begins (check-in from host 'Frank', user 'Frank1'); 1,240 encrypted Slack messages are recorded from this date on.
- Arbitrum Sepolia smart contract C2 activity begins; 1,402 transactions are recorded from this date on.
- Go module gocommunity.io/orderedbtree is published.
- Go module gogets.dev/btreex is published.
- Malicious npm version 0.2.21 is live for 35 minutes 38 seconds before removal (per THN).
- Aikido Security and The Hacker News disclose the malicious Terraform providers gocommunity-io/dockerd and kreuzwenker/docker and the two Go modules, with 18 unique victim hostnames observed.
- ReversingLabs publishes 'Graphalgo campaign moves upstream into infrastructure as code', describing the expansion into IaC.
Sources cited for Graphalgo Campaign Expands Upstream into Infrastructure as
- Graphalgo campaign moves upstream into infrastructure as code (ReversingLabs)
- Graphalgo Terraform and Go modules (Aikido Security)
- Attackers use malicious Terraform providers and Go modules (The Hacker News)
- Graphalgo malware analysis (GBHackers)
- Graphalgo Terraform/Go modules, September 2026 (Corgea)
- Inside Graphalgo (ReversingLabs)
- Graphalgo campaign respawned (ReversingLabs)
- Fake recruiter campaign targeting crypto developers (ReversingLabs)
- Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign (Security Affairs)
- Lazarus campaign plants malicious packages (The Hacker News)
Detection coverage for TL-2026-4328
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4328 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.