Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
What it means
Threat actors are using malicious Terraform providers and Go modules hosted on HashiCorp Registry to distribute Go-based malware. The malware uses blockchain and Slack for command-and-control, collects system data, and executes encrypted payloads. The attack leverages supply chain vulnerabilities and social engineering to target developers. A patch is not yet available, and the threat is expanding beyond traditional package repositories.
Why it matters
For Italian PMIs, this represents a new and sophisticated supply chain attack vector that can compromise development environments and infrastructure. The use of blockchain and Slack for C2 increases the risk of long-term data exfiltration and covert operations. The attack can lead to data breaches, operational disruption, and reputational damage.
Recommended actions
- Implement strict access controls and authentication for HashiCorp Registry access
- Audit and verify all Terraform providers and Go modules before deployment
- Enable monitoring of Slack API interactions and block unauthorized access
- Deploy network segmentation to isolate development and production environments
- Enable logging and monitoring for system information exfiltration
- Use EDR/XDR tools to detect and block suspicious command-and-control traffic
- Regularly update and patch all software components, including Terraform and Go modules
Potential operational benefits
- Riduzione della superficie esposta attraverso il controllo degli accessi
- Miglioramento della visibilità e della rilevazione degli attacchi
- Prevenzione di potenziali furti di dati e operazioni di controllo
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
- Source
- The Hacker News
- Publishing entity
- The Hacker News
- Entity type
- editorial osint
- Area
- Global
- Original language
- en · translation in preparation
- Publication
- 23/09/2026 20:06
- MITRE ATT&CK
- T1486, T1078