RESEARCHERS have uncovered a supply-chain campaign using fraudulent Terraform providers and poisoned Go modules to distribute a Go-based backdoor linked, with moderate confidence, to the Graphalgo intrusion cluster. In early September, attackers published typosquatted providers named `gocommunity-io/dockerd` and `kreuzwenker/docker`, the latter imitating the legitimate `kreuzwerker/docker` provider, which has 56 million downloads.
They also created fake package portals, `gogets.dev` and `gocommunity.io`, and backdated repository commits to November 2025. The campaign reportedly affects Windows, Linux and macOS systems and targets cloud architects and DevOps engineers who may have access to production credentials.
The malicious code is normally inactive and activates only when supplied with specific Terraform container and network values. Researchers from Aikido Security said the providers check whether the SHA256 hash of the concatenated values matches `b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5`. If it matches, the malware uses the value as an AES key, decrypts an embedded archive and launches a second-stage Go remote-access trojan.
That implant collects operating-system details, usernames and local Node.js installations, reporting them to an attacker-controlled Slack workspace. It can receive commands through Slack and the Arbitrum Sepolia testnet, including arbitrary Go or JavaScript instructions.
Aikido said plaintext Slack messages revealed 18 unique hostnames across 725 messages: ten macOS, five Linux and three Windows systems. Analysts found identical public keys in related campaigns, but attribution to a specific threat group remains unconfirmed. Recommended measures include pinning trusted Terraform namespaces, checking repository URLs, blocking untrusted Go mirrors and monitoring for unexpected Slack activity or connections to public blockchain RPC nodes.