Graphalgo — Terraform & Go Supply-Chain Hunt

A DPRK-linked actor (the Graphalgo cluster, publicly attributed to Lazarus by ReversingLabs since May 2025) has expanded its fake-recruiter supply-chain campaign beyond npm and PyPI into the HashiCorp Terraform Registry and the Go module ecosystem — the first publicly documented case of malware distributed through Terraform providers. Two trojanized Terraform providers (gocommunity-io/dockerd, and kreuzwenker/docker, a one-character typosquat of the legitimate kreuzwerker/docker provider with 56M downloads) and two malicious Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex) carry a Go RAT that is functionally a Go port of the existing Graphalgo npm/PyPI malware, sharing C2 infrastructure and a threat-actor public key with the JavaScript samples.

The attacker's objective is direct: reach a developer or DevOps workstation via a fake Web3 job-interview lure, get the victim to run a coding task that pulls in the trojanized package, and land a targeted, self-deleting RAT that is gated to fire only under narrow, attacker-chosen conditions (a specific SHA256 hash of Terraform variables, or a crafted numeric input) — explicitly to frustrate researchers who find the backend payload without its matching front end. The RAT's dual C2 (an Ethereum smart contract on the Arbitrum Sepolia testnet, and an attacker-controlled Slack workspace polled via conversations.history) is a sophisticated, low-noise dead-drop design built to survive endpoint remediation: because commands are pulled, not pushed, an attacker retains reachability even after the malicious package itself is removed.

The highest-value defensive angle is not trying to detect the AES-encrypted payload or the blockchain traffic content (both are opaque to EDR by design) — it is catching the narrow, low-FP process-lineage signature of a Terraform provider or Go module spawning a detached go run ., and locking down provider/module installation to a vetted mirror before a targeted developer or CI/CD runner is ever exposed. Terraform providers routinely run with direct access to cloud IAM credentials, so a single successful infection on a DevOps host is a materially worse outcome than the same RAT on a typical developer laptop.

Web Hunter decisions

• Prompt-injection scan: all four fetched sources were scanned for text directed at an AI agent (instructions to run commands, fetch other URLs, change output paths, claim authorization, etc.). None was found in any of the four sources. No source was dropped from citation for this reason.
• Provenance discipline: every atomic indicator shipped in this pack (Section 4, Section 10) was copied verbatim from one of the four saved snapshots and mechanically re-verified against them before publish. No indicator was invented.
• v0.2 revision — infrastructure de-duplication (this pass): the TraderTraitor typosquatted Terraform-registry domains (registry.hashicorp-aws.com, registry.hashicorp-aws.io, registry.hashicorp-terraform.io) were removed entirely after check_coverage.py --check-pack flagged them as shared infrastructure already owned by the published TraderTraitor-FLATROOF-ROOFDECK-Hunt.html pack. That is correct: those domains are TraderTraitor's own C2/distribution infrastructure, a distinct malware family (FLATROOF/ROOFDECK, Rust, macOS), not Graphalgo's. The query built on them (former Q9) was rewritten around a Graphalgo-owned indicator instead (see Section 8, Q9). The SentinelOne source is kept for narrative "Terraform Registry as an emerging attack surface" context only — it ships no IOCs here.
• Same reasoning applied to the GHAPPIER/PolinRider overlap: on review, the IP 193.247.144[.]38 and the trailing byte marker 68656c6c6f6970626f742121 ("helloipbot!!") are CloudSEK's GHAPPIER-loader indicators (via The Hacker News), overlapping with a distinct, long-running cluster called PolinRider — delivered through a different incident (the compromised @dforge-core/dforge-mcp npm package), not the Graphalgo Terraform/Go RAT. check_coverage.py did not flag these two specifically (the published PolinRider-Hunt.html currently ships them only as REPLACE_WITH_ placeholders, not live values), but the underlying attribution problem is identical, so they were removed from this pack on the same reasoning rather than waiting for the gate to catch a future collision once PolinRider-Hunt.html is populated. Hunters tracking that overlap should use PolinRider-Hunt.html.
• Single-source discipline: Aikido is the sole source for the campaign's payload hashes, C2 workspace names, and the threat-actor public key. Per standing IOC-governance policy, every indicator in this pack ships at Detect, never Prevent, until an independent second source corroborates it or a 14-day clean bake completes in your own tenant (see Section 11).
• No atomic IOC was converted to a placeholder — every remaining indicator in this pack is independently re-confirmed against the live sources and is exclusively Graphalgo's own infrastructure.

Hypotheses (ordered by fidelity): (1) a terraform-provider-* binary executes from a plugin cache path and spawns a detached go run . — highest confidence, lowest FP; (2) the exact typosquat string kreuzwenker appears in a process command line — near-zero FP; (3) a known-malicious payload hash is written to disk; (4) DNS resolution to the threat actor's fake Go ecosystem domains or its three named attacker Slack workspaces; (5) a CI/CD runner spawns terraform/go as a pivot toward production cloud credentials; (6) a non-Slack process polls api.slack.com broadly (medium confidence, DNS-level only); (7) a developer host talks to public blockchain RPC infrastructure with no Web3 business justification (low confidence, high FP, correlation-only).

All indicators below ship at action detect, not prevent — this pack is single-primary-sourced (Aikido) for the core Graphalgo Terraform/Go indicators. Promote to Prevent only after independent second-source corroboration or a clean 14-day bake in your own tenant (Section 11).

v0.2: the typosquatted Terraform-registry domains (TraderTraitor) and the GHAPPIER/PolinRider IP + trailing byte marker were removed from this table — they are other campaigns' own infrastructure, not Graphalgo's. See Section 2 for the full reasoning.

These checks require no Falcon query — they read the developer's own project files and are cheap enough to run fleet-wide via RTR or an MDM/RMM script before or alongside the CQL hunts.

Go dependency audit (Linux/macOS/Windows)

grep -RIn "gocommunity\.io\|gogets\.dev" $(find / -name "go.sum" -o -name "go.mod" 2>/dev/null) 2>/dev/null
# PowerShell equivalent:
Get-ChildItem -Recurse -Include go.sum,go.mod -ErrorAction SilentlyContinue |
  Select-String -Pattern "gocommunity\.io|gogets\.dev"

Terraform lock-file audit

grep -RIn "kreuzwenker\|gocommunity-io" \
  $(find / -name ".terraform.lock.hcl" 2>/dev/null) 2>/dev/null

GitHub organization / vendoring audit

Check whether any internal repo forks, vendors, or references code from the threat-actor-controlled GitHub identities: gocommunity-io, go-pack-tech, kreuzwenker, gogets-dev, victormmpp, markcary3, steveb082, go-community-admin.

Slack workspace visibility — an honest limit

This campaign's Slack C2 uses attacker-owned workspaces (portfolio-devs.slack.com, portfolio-testers.slack.com, mediumstar.slack.com) reachable from any host with outbound HTTPS. There is no native audit-log visibility into this from your own Slack tenant — your Slack admin console cannot see traffic to someone else's workspace. Rely on DNS/proxy/CASB egress logs (Q4, Q9) instead. Your own Slack Enterprise Grid App Manager audit is still worth running as a separate hygiene check, for any bot/app token with a conversations.history or channels:history scope your security team did not provision.

Q4, Q7, and Q8 remain investigate-only hunt queries — each carries FP risk medium or higher and is designed as a correlation pivot, not a standalone detection. Do not promote them to Custom IOA/IOC.

Playbook A — Terraform CLI Provider-Installation Lockdown

# ~/.terraformrc (Linux/macOS) or %APPDATA%\terraform.rc (Windows)
# Restrict provider installation to an internal mirror; block direct registry.terraform.io
# fetches for anything not explicitly excluded. Verified syntax: developer.hashicorp.com/
# terraform/cli/config/config-file

provider_installation {
  network_mirror {
    url = "https://terraform-mirror.internal.example.com/"
  }
  direct {
    exclude = ["registry.terraform.io/*/*"]
  }
}

Prerequisites: An internal Terraform provider mirror (filesystem_mirror or network_mirror endpoint) deployed and reachable; an inventory of currently-used providers pre-loaded into the mirror so existing builds do not break on rollout.
Reboot required: No.
Rollback: Remove or comment out the provider_installation block (or restore the previous .terraformrc/terraform.rc backup); the next `terraform init` reverts immediately to default direct-registry installation.

Playbook B — Falcon Custom IOC Bulk Import

# Falcon IOC Management -- bulk import via API (requires an API client with iocs:write scope)
# The CSV payload is the grab-csv block in Section 10; convert to Falcon's JSON indicator
# schema before POSTing, or use the IOC Manager console's CSV import.

curl -s -X POST "https://api.crowdstrike.com/iocs/entities/indicators/v1" \
  -H "Authorization: Bearer $FALCON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": [
      {
        "type": "sha256",
        "value": "5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f",
        "action": "detect",
        "severity": "critical",
        "platforms": ["windows", "linux", "mac"],
        "description": "Graphalgo Terraform-provider payload archive (import-resource.sqlite3)"
      }
    ]
  }'

Prerequisites: Falcon IOC Management enabled for the tenant; an API client credential scoped to iocs:write, or console access with the IOC Manager role.
Reboot required: No.
Rollback: Delete the imported indicator entries via IOC Management (console) or `DELETE /iocs/entities/indicators/v1` (API); does not touch endpoint state and takes effect immediately.

Playbook C — Windows Execution-Control Rule (AppLocker, Audit-First)

# Windows -- AppLocker path-rule sketch (Audit mode first; promote to Enforce after a bake period)
# Deny execution of terraform-provider-* / go binaries from user-writable roots; allow only
# from managed installation paths.

New-AppLockerPolicy -XMLPolicy (
@"
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="9c4c2f4e-0001-4a3a-9c1a-000000000001" Name="Deny terraform-provider-* from user-writable roots"
                  Description="Graphalgo hardening - Section 13 Playbook C" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="%LOCALAPPDATA%\*terraform-provider-*.exe" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="9c4c2f4e-0001-4a3a-9c1a-000000000002" Name="Deny go.exe from Temp/Downloads"
                  Description="Graphalgo hardening - Section 13 Playbook C" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePathCondition Path="%TEMP%\go.exe" />
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>
"@) | Set-AppLockerPolicy -Merge
gpupdate /force

Prerequisites: AppLocker's Application Identity service running and the GPO already in Audit mode on the target ring; a baseline capture of legitimate signed Terraform/Go binary install paths so the deny rules do not need to also cover them.
Reboot required: No reboot; the Application Identity service may need a one-time restart if this is its first AppLocker deployment on the host (`Restart-Service AppIDSvc`), and `gpupdate /force` applies the policy without a reboot.
Rollback: Remove the two FilePathRule entries (or revert the RuleCollection to AuditOnly / unlinked) and run `gpupdate /force`; no endpoint state changes are made by the policy itself, only future execution attempts are affected.

Validation gates (Section 11) apply to every row above marked Good or Partial before promotion to Prevent/Block.