Skip to content

Back to the catalog

Graphalgo campaign spreads to Terraform providers and Go Modules
aikido.devwriteup

Graphalgo campaign spreads to Terraform providers and Go Modules

Aikido documents the Graphalgo malware campaign's expansion beyond NPM into two malicious Terraform providers (gocommunity-io/dockerd and the kreuzwerker/docker typosquat kreuzwenker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex), marking the first observed systematic Terraform provider malware distribution. The payload is a Go port of Graphalgo sharing blockchain infrastructure, Slack C2, and a public key with prior JS/NPM samples; it activates only under specific hash-gated runtime conditions (targeted attack indicator), then deploys a Go RAT with dual C2 channels — an Ethereum (Arbitrum Sepolia) smart-contract dead drop and Slack bot messaging — plus self-delete and remote code execution capabilities. The threat actor also stood up two fake Go package ecosystem websites (gocommunity.io, gogets.dev) to socially engineer developers and backdated Git commits to obscure module publication timing.

TL;DR The Graphalgo NPM supply-chain campaign now hits Terraform providers and Go modules with a hash-gated Go RAT using Slack + Ethereum smart-contract dead-drop C2.
Open original ↗
Document

What it is

The Aikido writeup on the Graphalgo Go port carries the concrete IOCs and detection guidance the summary cannot. The malicious packages (all versions): Terraform providers gocommunity-io/dockerd and kreuzwenker/docker (typosquat of kreuzwerker/docker, 56M downloads); Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. The shared threat-actor Ed25519 public key, reused across NPM payloads since April 2026 (first in modern-events), is 302a300506032b656e032100bad013df6eec5d686f4cc8551e0a5c87a0135164bdd1dafb1c75141d1b526702.

How it works

Both Terraform providers hide entry points in /internal/provider/resource_docker_container_funcs.go. The stage-1 fires only when SHA256(containerName + networkID) equals b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5 — that hash is then used as the AES key to decrypt and go run . the second stage from a ZIP masquerading as import-resource.sqlite3. The gogets.dev/btreex module activates only when processing an object with a specific price integer; gocommunity.io/orderedbtree shipped the payload in plaintext.

The RAT runs dual C2. It check-ins system info to Slack channel frontend-devs in portfolio-devs.slack.com via api.slack.com (workspace subdomain never contacted directly), then moves encrypted traffic to qa-announcements in portfolio-testers.slack.com. Blockchain C2 uses an Arbitrum Sepolia contract at 0xAD02b5cDE693529d3bdA0266299501ad0193036C (setCPubKey write, commands read from serviceData1/serviceData2). Polling: blockchain every 3s, Slack every 10s. Command headers select Go execution, JS via node, or self-delete.

What to do

Block/hunt these IOCs:

# File hashes (ZIP payloads disguised as SQL)
import-resource.sqlite3  5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f
btreex.sql               ab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5

# Domains (fake Go ecosystems, non-functional)
gocommunity[.]io   gogets[.]dev

# Slack workspaces
portfolio-devs.slack.com   portfolio-testers.slack.com
mediumstar.slack.com   # historical, previously unreported

Aikido's explicit detection recommendation: organizations with no business need for blockchain should alert on network communications to HTTP-based blockchain/RPC services — the dead-drop pattern is growing across malware families.

Caveats

  • Both providers/modules are inert without the specific hash-gated or price-gated input, so scanning for the packages matters more than dynamic detonation.
  • Go Modules treats commit dates as authoritative, so gogets.dev/btreex (published 8 Sep) displays a backdated Nov 2025 release on the proxy and pkg.go.dev — do not trust the shown publish date.
  • Scale is small/targeted: 18 unique hostnames (3 Windows, 5 Linux, 10 macOS) across plaintext check-ins; Aikido lacks data to notify victims.

Organisations named here

  • Graphalgo

Technologies named here

  • gocommunity-io/dockerd
  • Aikido Intel
  • kreuzwenker/docker
  • Terraform
  • gocommunity.io/orderedbtree
  • Go Modules / pkg.go.dev / Go module proxy
  • gogets.dev/btreex
  • modern-events
  • Go
  • Slack
  • Ethereum
  • SQLite
  • npm
  • ReversingLabs
  • SafeDep
  • Checkmarx

Techniques named here

  • Conditional/triggered malware activation
  • AES key derivation from hash for decryption
  • Detached process execution of decrypted payload
  • Blockchain dead drop C2
  • Slack-based C2 channel
  • Ephemeral key exchange for shared-key encryption
  • Encrypted Ethereum wallet private key retrieval
  • Typosquatting
  • Commit date forgery
  • Fake ecosystem websites for social engineering
  • Input-triggered activation

Threat actors named here

  • Graphalgo campaign threat actor
  • Graphalgo malware

Related in Supply Chain