# Graphalgo Campaign Expands Upstream into Infrastructure as Code via Malicious Terraform Providers and Go Modules

> The DPRK-linked Graphalgo campaign, previously seen distributing malicious npm and PyPI packages through fake recruiter coding tasks, has expanded to the HashiCorp Terraform Registry and the Go module ecosystem. Two malicious Terraform providers (one typosquatting the 56M-download kreuzwerker/docker provider) and two Go modules deliver a hash-gated Go RAT that uses an Arbitrum Sepolia smart contract and Slack as dual C2 channels.

- **Published:** 2026-10-24T01:30:01Z
- **Last reviewed:** 2026-10-24T01:30:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4328
- **ID:** TL-2026-4328
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Graphalgo operators (North Korea)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Aikido Security (published around 2026-09-23) and ReversingLabs (blog 2026-10-21) describe a Go port of the Graphalgo malware delivered through two Terraform providers, gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads), and two Go modules, gocommunity.io/orderedbtree (published 2026-08-11) and gogets.dev/btreex (published 2026-09-08). kreuzwenker/docker typosquats the legitimate kreuzwerker/docker provider, which has about 56 million downloads. Aikido describes this as the first confirmed use of the Terraform Registry as a malware distribution vector. Because Terraform providers execute during provisioning, often on hosts that already hold cloud credentials, source access and deployment secrets, the blast radius extends from a single application to the underlying cloud environment.

The malware is hash-gated. In the Terraform providers it activates only when the SHA256 of the concatenated containerName and networkID equals b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5. That value doubles as an AES key that decrypts the payload file paths and payloads, so sandboxes and automated scans never see the payload. The payload is staged in examples/resources/docker_container/import-resource.sqlite3 (providers) and btreex.sql (Go module). In gogets.dev/btreex the gate requires a specific price integer value in processed objects. THN reports that the payload decrypts only when the victim solves a linear system with a specific matrix.

The second-stage RAT collects OS, architecture, hostname, username, home directory, Node.js availability and current time, and reports them to Slack. It runs two C2 channels. The first is a blockchain dead drop on the Arbitrum Sepolia testnet: smart contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C is polled every 3 seconds, and the implant registers an ephemeral public key through the setCPubKey method. The second is a Slack bot token: check-ins go to the frontend-devs channel in portfolio-devs.slack.com, and commands arrive from the qa-announcements channel in portfolio-testers.slack.com, polled through conversations.history every 10 seconds. Traffic is encrypted per victim with asymmetric cryptography. Commands run as Go or JavaScript code through node, or trigger self-deletion, and file transfer uses Start/Chunk/End packet types. The actor public key is shared with recent JavaScript samples, first seen in the npm package modern-events in April 2026.

Aikido recorded 18 unique victim hostnames (3 Windows, 5 Linux, 10 macOS), 725 plaintext check-in messages, 1,240 encrypted Slack messages since 2026-07-16 and 1,402 blockchain transactions since 2026-08-06. Testing began on 2026-07-16 from a host named Frank (user Frank1). The actor registered the fake ecosystem domains gocommunity.io and gogets.dev within one day of creating the matching GitHub organizations, and used forged commits and multiple committer accounts to make the repositories look legitimate.

The original Graphalgo campaign, documented by ReversingLabs in February 2026, used a fake blockchain firm (Veltrix Capital) and recruiter coding tasks whose repositories pulled in malicious npm and PyPI dependencies such as bigmathutils and graphnetworkx. The ReversingLabs IaC post describes the current operation as small and targeted. THN reports links to North Korean clusters (TraderTraitor, Contagious Interview, PolinRider). ReversingLabs' own post does not name an actor, so attribution is rated MEDIUM.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1566.003 Spearphishing via Service
- T1059 Command and Scripting Interpreter
- T1059.007 JavaScript
- T1036.005 Match Legitimate Resource Name or Location
- T1480.001 Environmental Keying
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1573.002 Asymmetric Cryptography

## Sources

- [Graphalgo campaign moves upstream into infrastructure as code (ReversingLabs)](https://www.reversinglabs.com/blog/graphalgo-campaign-moves-upstream-into-infrastructure-as-code)
- [Graphalgo Terraform and Go modules (Aikido Security)](https://www.aikido.dev/blog/graphalgo-terraform-go-modules)
- [Attackers use malicious Terraform providers and Go modules (The Hacker News)](https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html)
- [Graphalgo malware analysis (GBHackers)](https://gbhackers.com/graphalgo-malware/amp/)
- [Graphalgo Terraform/Go modules, September 2026 (Corgea)](https://corgea.com/research/graphalgo-terraform-go-modules-september-2026/)
- [Inside Graphalgo (ReversingLabs)](https://www.reversinglabs.com/blog/inside-graphalgo)
- [Graphalgo campaign respawned (ReversingLabs)](https://www.reversinglabs.com/blog/graphalgo-campaign-respawned)
- [Fake recruiter campaign targeting crypto developers (ReversingLabs)](https://www.reversinglabs.com/blog/fake-recruiter-campaign-crypto-devs)
- [Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign (Security Affairs)](https://securityaffairs.com/188009/apt/malicious-npm-and-pypi-packages-llinked-to-lazarus-apt-fake-recruiter-campaign.html)
- [Lazarus campaign plants malicious packages (The Hacker News)](https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4328