Graphalgo campaign: malicious Terraform providers and Go modules deliver targeted RAT via hash-triggered payload (no CVE)
Severity: high · Patch status: no-fix-needed · Since 2026-09-22
Aikido identified Go malware distributed via two Terraform providers (gocommunity-io/dockerd and typosquat kreuzwenker/docker of the popular kreuzwerker/docker provider) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex), extending the Graphalgo NPM malware campaign first reported by ReversingLabs in February 2026. Hidden entry points activate only when a SHA256 of concatenated containerName and networkID matches a specific value, then AES-decrypt and execute a second-stage RAT from an embedded ZIP. The RAT exfiltrates system info to a Slack workspace and uses dual C2 via Slack channels and Ethereum dead drops on Arbitrum Sepolia with ECDH-encrypted communications. The hash-gating suggests targeted delivery; any developer or CI system pulling these packages is at risk. No vendor fix applies—removal and rotation are the remediation.
What to do
- Audit Terraform and Go dependency trees for the malicious packages (gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree, gogets.dev/btreex) and remove them immediately
- If found installed, treat hosts as compromised: rebuild machines/CI runners, rotate credentials, tokens, and Slack tokens accessible from them
- Verify the legitimate kreuzwerker/docker Terraform provider is used (correct spelling) and pin provider/module versions and checksums
- Scan for artifacts and indicators: the trigger SHA256 b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5, payload ZIP hash 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f, and connections to portfolio-devs/portfolio-testers Slack workspaces
- Block or monitor egress to api.slack.com and Arbitrum Sepolia RPC endpoints from build and developer environments
- Use dependency/malware scanning (SCA, SBOM) on Go modules and Terraform providers before adoption
Sources
All live incidents on Threat Watch
