[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRVmRcbyHxfwHu0TXekoUMH1R2Bka9QPfP4vPOxvjcSM":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"acd1b4a8-51c4-4c2f-9c6c-2338faee9af1","Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry","attackers-use-malicious-terraform-providers-to-deliver-go-malware-via-hashicorp--d1ccb5","Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io\u002Fdockerd (222 downloads) kreuzwenker\u002F","Threat actors are leveraging the HashiCorp Registry, distributing Go-based malware through malicious Terraform providers and Go modules. This marks the first known instance of this repository being used as a malware distribution vector. The malware exhibits similarities to the Graphalgo campaign, attributed to North Korean actors, and utilizes dual command-and-control channels via blockchain and Slack.","Attackers use malicious Terraform providers and Go modules to distribute Go malware.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-use-malicious-terraform.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj8VNxKl5_NBWXcUoDi3VxoksbOSAixGFGd8EmIaZmKRQpsGhOj6SLg8fmHktJbtvR7wofZNG1AFIzSGnVFq8OJHgq27dhqNtc0cz457ZqqQQ6INHwnExfLu3xKERaNt0GmOpxJ6WR6oxp5FZTT-q3Q5YWAnVawXYfY51GRl09ovsDkhM3U8tRUTR4ClSfj\u002Fs1600\u002Fterraform.jpg","2026-09-23T18:06:30+00:00","2026-09-23T20:00:12.699043+00:00",9,[17,20,23,26],{"name":18,"type":19},"Terraform","product",{"name":21,"type":22},"HashiCorp","vendor",{"name":24,"type":25},"Go Modules","technology",{"name":27,"type":25},"npm","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":28,"icon":30,"name":31,"slug":32},null,"Supply Chain","supply-chain",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":54,"vendors":138},[55,84,112],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":50,"name":85,"problem":86,"products":87},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":113,"name":114,"problem":115,"products":116},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[117,125,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":126,"product_name":127,"url":128,"description":129},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[139,144],{"slug":140,"name":21,"logo_path":141,"roles":142},"hashicorp","\u002Fvendor-logos\u002Fhashicorp.png",[143],"affected",{"slug":118,"name":119,"logo_path":120,"roles":145},[146],"reported_by",{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":161},"malicious-terraform-providers-weaponize-hashicorp-registry-for-go-malware-distribution","Malicious Terraform Providers Weaponize HashiCorp Registry for Go Malware Distribution","Threat actors exploited the inherent trust developers place in public package registries by publishing malicious Terraform providers to the HashiCorp Registry, marking a novel supply chain attack vector. The malware, linked to North Korean-attributed actors, embedded dual command-and-control channels via blockchain and Slack to evade traditional network-based detection. This attack highlights the growing risk of typosquatting and malicious package publication in trusted developer ecosystems — a tactic that bypasses perimeter defenses by compromising the software supply chain at the source. Organizations that blindly consume third-party providers without vetting introduce unverified code directly into their infrastructure-as-code pipelines, with potentially catastrophic consequences. The incident underscores that trust in a registry's brand does not equate to trust in every package it hosts.",[152,153,154,155,156,157,158,159,160],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-218: Secure Software Development Framework (SSDF) — PW.4 (Reuse Existing, Well-Secured Software)","NIST CSF DE.CM-3: Personnel activity monitoring","NIST CSF ID.SC-2: Supplier risk assessment","SLSA Framework Level 2+: Provenance and build integrity requirements","OWASP Top 10 A06:2021 — Vulnerable and Outdated Components","Executive Order 14028 (US): Software Bill of Materials (SBOM) requirements",{}]