Malware in Terraform Providers: SHA256 Hash and Blockchain Used for Activation

North Korean-linked threat actors published malicious Terraform providers in the HashiCorp Registry and Go modules on fake sites, extending the Graphalgo campaign from npm and PyPI to a vector closer to production cloud credentials. The discovery, published September 22, 2026 by Aikido, documents a conditional activation mechanism based on the SHA256 hash of runtime variables and a dual command-and-control channel leveraging the Ethereum blockchain and Slack.

How Conditional Activation Works

The malicious provider kreuzwenker/docker is a typosquat of the legitimate kreuzwerker/docker, which has recorded approximately 56 million downloads. A single-letter difference in the name exposes users to a package that, on the surface, replicates the official provider's functionality but contains added code in the resource_docker_container_funcs.go file.

Activation is not immediate: the malware calculates the SHA256 of the concatenation of two Terraform variables, containerName and networkID, and compares the result with the hardcoded hash b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5. Only when the value matches is the hash used as an AES key to decrypt the payload path hidden inside the file examples/resources/docker_container/import-resource.sqlite3.

This architecture renders static scanning ineffective: without the correct runtime variables, the .sqlite3 file appears as legitimate sample data and the malicious code remains inert. The malware is therefore designed to activate in specific environments, presumably those of developers targeted via the "fake interview" social engineering campaigns typical of DPRK operators.

Dual C2 Channel: Blockchain as Dead Drop, Slack for Control

Once activated, the malware establishes two asynchronous communication channels. The first is a smart contract on the Arbitrum Sepolia testnet, address 0xAD02b5cDE693529d3bdA0266299501ad0193036C, used as a blockchain dead drop: the actor inserts encrypted commands into the blockchain, where they remain accessible but not directly traceable to a traditional C2 server.

The second channel leverages Slack APIs with bot tokens. The initial check-in occurs in the frontend-devs channel of the portfolio-devs.slack.com workspace; subsequent communications migrate to portfolio-testers.slack.com in the qa-announcements channel. The malware generates ephemeral key pairs and uses shared keys to decrypt messages destined for its own client, discarding those for other infected endpoints.

"The C2 mechanism is further indication that this malware is part of a targeted operation. The threat actor's ability to issue commands is bottlenecked because all clients consume all messages and no-op when they fail to decrypt messages intended for other clients" — Oliver Smith, Aikido

Polling is measured: every 3 seconds for the blockchain, every 10 seconds for Slack. The qa-announcements channel contained 1,240 encrypted messages from July 16, 2026; the blockchain contract had recorded 1,402 transactions from August 6, 2026, according to Aikido data.

Shared Infrastructure with Graphalgo and Extension to Go

The malware is a Go port of the Graphalgo campaign, originally documented by ReversingLabs in February 2026 on npm and PyPI. Continuity is verified through concrete elements: the same Ed25519 public key (302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702), already found in npm payloads from April 2026; the same smart contract addresses; the same Slack workspaces.

The actors built a fake ecosystem to sustain distribution: sites like gogets.dev and gocommunity.io mimic legitimate Go registries, with modules requiring specific inputs for activation. The module gogets.dev/btreex, for example, requires a precise integer price value and uses backdated commits from November 2025 to appear established.

Eighteen unique hostnames were identified in check-in messages: 3 Windows, 5 Linux, 10 macOS. The first message in the Slack channel is dated July 16, 2026, from a Windows device with hostname Frank and username Frank1. However, the dossier does not specify whether these 18 hostnames refer exclusively to the Terraform vector or include victims of the Graphalgo campaign on npm.

What to Do Now

• Inspect .terraform.lock.hcl lock files: verify that declared providers match official names exactly, without single-letter typosquatting like kreuzwenker instead of kreuzwerker.
• Restrict provider downloads to approved registries and, where possible, to verified internal mirrors, reducing the exposure surface to packages published directly in the HashiCorp Registry.
• Implement hash pinning for Terraform providers, systematically comparing expected hashes with those actually downloaded in the CI/CD workflow.
• Monitor outbound traffic to unauthorized Slack API endpoints and to blockchain testnets like Arbitrum Sepolia in build and production environments.

Attribution and Dossier Limits

The Aikido report and quotes from Karlo Zanki for Socket converge in linking the operation to DPRK actors, but with different gradations. Zanki, cited by The Hacker News, stated: "Too early to conclude with confidence that DPRK actors are using Terraform registries as a new tactic, but the presence in two separate campaigns makes coincidence less likely."

The dossier does not identify the specific DPRK group with certainty: Graphalgo presents operational overlaps with TraderTraitor, Jade Sleet, and Famous Chollima, but attribution to a precise APT is not definitive. The publication method in the HashiCorp Registry is unknown (compromised account or created from scratch), as is the number of downloads the malicious providers actually received before removal.

The final encrypted payload, recovered but not decrypted by SafeDep/JFrog, keeps the exact functionality of the post-activation stage uncertain. The malware collects system information (hardware, OS, hostname, node availability) but the dossier does not specify the nature of any further exfiltrated data.

The extension from traditional package managers (npm, PyPI) to the HashiCorp Registry marks a significant escalation: Terraform providers operate with elevated privileges on cloud infrastructure, with direct access to AWS credentials and deployment states. In this context, conditional activation is not a superfluous technical complication: it is the requirement that allows the malware to traverse entire security pipelines without leaving statically analyzable traces.

Sources

• https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html
• https://www.aikido.dev/blog/graphalgo-terraform-go-modules
• https://gbhackers.com/terraform-lock-files/
• https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers
• https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html
• https://thehackernews.com/2026/04/new-wave-of-dprk-attacks-uses-ai.html#graphalgo-uses-fake-companies-to-drop-rat
• https://thehackernews.com/2026/09/malicious-npm-package-indexed-btree-hid.html
• https://thehackernews.com/2026/09/jade-sleet-linked-to-indian-it-provider.html

Information has been verified against cited sources and updated at time of publication.

Sources