Malware has infiltrated the tools developers use to build and manage cloud infrastructure. This routine development work can now potentially compromise valuable machines. The operator could issue commands via Slack or an Ethereum test network smart contract, instructing infected systems to execute additional Go or JavaScript code or remove malware.

This tactic aligns with Graphalgo's broader attacks on developer packages, but the new research does not independently pinpoint the identity of the perpetrator behind these specific Terraform providers. Aikido recommends isolating the machine or build runner, rotating credentials it could access, and reviewing recent code changes, package releases, Terraform runs, and automated builds for signs of misuse.

Here are the indicators of compromise (IoCs):

  • **Type Indicator Description**
  • Malicious Terraform provider: gocommunity-io/dockerd
  • Malicious Terraform provider: kreuzwenker/docker
  • Typosquatted Terraform provider containing malware: containing malware
  • Go module containing malware: gocommunity.io/orderedbtree
  • Go module containing malware: gogets.dev/btreex
  • Archive used by malicious Terraform providers: import-resource.sqlite3
  • Disguised archive used by the malicious Go module: btreex.sql
  • Trigger hash used by the Terraform-provider payload: 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702
  • Hardcoded threat actor public key: 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702
  • Ethereum smart contract: 0xAD02b5cDE693529d3bdA0266299501ad0193036C
  • Arbitrum Sepolia contract used for command-and-control: 0xAD02b5cDE693529d3bdA0266299501ad0193036C
  • Slack workspace: hxxps[:]//portfolio-devs.slack[.]com, hxxps[:]//portfolio-testers.slack[.]com, hxxps[:]//mediumstar.slack[.]com
  • Historical unreported indicator: Slack workspace
  • IP addresses and domains are defanged to prevent accidental resolution or hyperlinking.