Aikido Security researchers have discovered a new supply chain attack called Graphalgo, in which a malicious Go-based RAT is distributed through Terraform providers and Go modules. This marks the first documented delivery of malware through the HashiCorp Registry: attackers published the malicious providers gocommunity-io/dockerd and kreuzwenker/docker (a typosquat of the popular kreuzwerker/docker with 56 million downloads), as well as the Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The campaign uses targeted triggers, blockchain and Slack for command and control, making detection extremely difficult.
Key IOCs: Terraform providers gocommunity-io/dockerd and kreuzwenker/docker; Go modules gocommunity.io/orderedbtree and gogets.dev/btreex; domains gocommunity[.]io and gogets[.]dev; Ethereum contract 0xAD02b5cDE693529d3bdA0266299501ad0193036C on Arbitrum Sepolia; Slack workspaces portfolio-devs.slack[.]com and portfolio-testers.slack[.]com.
The malicious Terraform providers contain hidden entry points in the file /internal/provider/resource_docker_container_funcs.go that activate only when specific conditions are met. The malware remains dormant unless the SHA256 hash of the concatenated Terraform variables containerName and networkID matches the target value b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5. This mechanism means the malicious provider is harmless in most cases and activates only during a targeted attack against specific infrastructure.
go run . process in the backgroundThe use of a specific trigger undermines sandbox testing: a scanner installing the Graphalgo provider with ordinary inputs sees a normal Docker provider. The attacker apparently knew or expected to learn the exact container and network names used by the target, suggesting reconnaissance or social engineering before the package was downloaded. This is a classic sign of a targeted operation rather than a mass campaign.
The Go module gogets.dev/btreex first appeared on September 8, but the attacker forged commits to make them appear to date back to November 2025. Because Go Modules treats commit dates as authoritative, the Go module proxy and pkg.go.dev displayed the falsified date. The attacker also created two fake Go package websites — gogets.dev and gocommunity.io — to make the packages appear to be established projects.
The second stage of the Graphalgo RAT is a Go agent with two command-and-control channels, making it particularly resilient to detection and blocking. The malware initially collects system information, including hardware attributes, OS details, hostname and the availability of Node on the infected system, and then transmits this data through both channels.
The malware sends the collected information to the frontend-devs Slack channel in the portfolio-devs.slack[.]com workspace (Portfolio Devs). Notably, the malware communicates with api.slack.com, and the workspace subdomain is not contacted directly. For Slack C2 communications, the malware uses the hardcoded public key 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702.
Slack API traffic is common in most corporate networks, so egress filtering is unlikely to flag Graphalgo check-ins. This makes Slack an ideal channel for covert communication in environments where developers actively use the platform.
For blockchain-based C2, the malware retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet using the hardcoded contract address 0xAD02b5cDE693529d3bdA0266299501ad0193036C. The process works as follows:
The C2 mechanism provides further evidence that this malware is part of a targeted operation. The threat actor's ability to issue commands is constrained because all clients consume all messages and perform a no-op when they cannot decrypt messages intended for other clients. This is a particularly sophisticated implementation of a blockchain dead drop that integrates bidirectional communication with minimal risk of information leakage or disruption. The malware polls the blockchain every 3 seconds.
| C2 Channel | Polling Interval | Platform | Purpose |
|---|---|---|---|
| Slack | 10 seconds | api.slack.com | Initial contact, key exchange |
| Blockchain | 3 seconds | Arbitrum Sepolia | Dead-drop commands, persistent communication |
Blockchain traffic is less common in corporate networks. Aikido recommends that organizations without a business need to interact with blockchains configure alerts for network connections to HTTP-based blockchain services. On command, the malware can execute additional Go or JavaScript code or delete itself.
If any of the Graphalgo packages or providers were installed on a developer machine or CI/CD runner, the entire environment should be considered compromised. Simply removing the package is not sufficient to clean the machine because the malware launches its second stage as a detached background process.
go run . process, removing the package alone does not guarantee that everything it launched is gone. Reimaging is the only way to be certain the host is cleanThis week, confirm that none of the four Graphalgo packages exist anywhere in your environment, identify everyone inside or outside the company who runs Terraform with production credentials, and shorten the lifetime of those credentials. These three actions address the Graphalgo campaign specifically as well as the broader class of attacks targeting infrastructure tools.
For teams running Terraform in-house, it is necessary to:
Critical note: Reimaging is the only reliable way to clean the system. The malware launches its second stage as a detached process, so removing the provider does not stop code that is already running. Any machine that installed these packages should be considered fully compromised, and all cloud credentials it had access to should be rotated.
The Graphalgo campaign represents the first documented delivery of malware through Terraform providers, but it fits into a growing trend of supply chain attacks targeting infrastructure tools. Terraform is used by more than 75% of companies to manage cloud infrastructure, making it an attractive target for attackers seeking access to production environments through DevOps workstations.
The use of blockchain and Slack for C2 reflects the evolution of malware techniques, with attackers using legitimate services for covert communication. This makes detection more difficult because the traffic resembles ordinary business activity. Blockchain dead drops are becoming increasingly popular among advanced threat actors because they provide infrastructure that is resilient to takedowns.
To prevent similar attacks, organizations should implement a multi-layered supply chain security strategy. This includes using private registries for all infrastructure packages, mandatory verification of checksums and signatures before installation, segmentation of access to production credentials and continuous monitoring of network activity for anomalous connections to blockchain services.
The Graphalgo campaign demonstrates that even well-known and widely used Infrastructure as Code tools can become vectors for sophisticated targeted attacks. The combination of specific triggers, dual C2 infrastructure and a falsified release history demonstrates the high level of sophistication of the threat actors behind this operation. Organizations should reassess their approaches to supply chain security and treat infrastructure tools with the same rigor as critical production systems.
“Supply chain security is not about trusting every link, but verifying every link. In the world of Infrastructure as Code, a single unverified provider can become a doorway into your entire cloud infrastructure.”
— Bruce Schneier, cryptographer and security expert
