Poisoned Pipeline / Incidents / AS40
Graphalgo spreads to Terraform providers and Go modules
Aikido found Graphalgo-family Go malware in two Terraform providers
(gocommunity-io/dockerd and kreuzwenker/docker, a typosquat of
kreuzwerker/docker with 56 million reported downloads) and two Go
modules (gocommunity.io/orderedbtree, first seen 11 August 2026, and
gogets.dev/btreex, 8 September). This is the first malware Aikido
observed via Terraform providers. The providers stay inert unless
SHA-256(containerName + networkID) equals a fixed digest; that digest
decrypts a ZIP hidden as import-resource.sqlite3, then a detachedgo run . executes the second stage. The RAT checks in to Slack
(frontend-devs / qa-announcements; 1,240 messages since 16 July) and
polls an Arbitrum Sepolia contract every 3 seconds. Actor key
302a3005…b526702 is shared with Graphalgo npm samples since April
(modern-events). gogets.dev/btreex hid the payload in a fake .sql
file and activated on a specific price integer; forged commits were
backdated to November 2025 so the Go module proxy showed a false
release date. The operator stood up two non-functional vanity Go
sites (gocommunity.io, gogets.dev) next to attacker GitHub orgs.
Slack check-ins named 18 hostnames (3 Windows, 5 Linux, 10 macOS).
Mapped techniques
- T0108 Accounts in public registry
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0150 Runtime logic bomb
- T0159 Malicious artifact execution
- T0172 Runtime backdoor
- T0141 Fake developer reputation (Starjacking)
- T0195 Spoofed Commits
supply-chain Malicious Terraform providers
Attacker-controlled Terraform registry namespaces gocommunity-io and kreuzwenker.
kreuzwenker/docker impersonates kreuzwerker/docker (56M downloads).
Providers gocommunity-io/dockerd and kreuzwenker/docker published in early September.
Payload decrypts only when SHA-256(containerName+networkID) matches one digest.
Detached go run . of AES-decrypted ZIP posing as import-resource.sqlite3.
Go RAT with Slack C2 plus Arbitrum Sepolia contract polling.
supply-chain Malicious Go modules and fake ecosystems
Modules gocommunity.io/orderedbtree and gogets.dev/btreex under attacker vanity paths.
gocommunity.io and gogets.dev look like Go package ecosystems; they do not accept third-party packages.
orderedbtree (11 Aug, plaintext malware) and btreex (8 Sep, malware in a fake .sql).
Forged commits backdated to Nov 2025 so the Go module proxy showed a false release date.
btreex activates only when processing an object with one specific price integer.
Same Graphalgo Go RAT as the Terraform providers.
Shared Slack workspaces and Ethereum key with April npm Graphalgo.
Framework gaps noted
- Slack workspace plus Arbitrum smart-contract C2 is not a named technique.
- Standing up fake vanity Go ecosystems as social-engineering fronts is only partly covered by T0141.