North Korea Uses Terraform to Spread Go Malware
Attackers hid malware in trusted developer tools. This new campaign targets software engineers globally.
Key points
- Malware was found in two Terraform providers and two Go modules on HashiCorp's registry.
- The campaign is linked to North Korean actors and uses fake job offers to recruit targets.
- The malware uses Slack and Ethereum blockchain contracts as hidden command-and-control channels.
Cybersecurity researchers found new malware. It hides inside common developer tools. The attack targets Go language developers. This marks a first for the platform.
Threat actors used trusted repositories. They hid malicious code in specific packages. These tools are standard for building software. The discovery was made by Aikido.
Trusted tools used for attacks
Two Terraform providers contained the malware. Two Go modules were also infected. One package had 222 downloads. Another had 1,449 downloads. These numbers show real usage.
The code looks harmless at first. It only activates under specific conditions. This makes it hard to detect. It is a targeted operation.
Link to North Korean campaign
Researchers link this to Graphalgo. That campaign appeared earlier this February. It is attributed to North Korea. The tactics remain similar.
Attackers pose as Web3 companies. They contact developers on social media. They offer fake job tasks. The task leads to the malware.
Hidden control channels
The malware uses two control channels. One is a Slack bot token. The other is a blockchain contract. This allows silent communication.
It polls a Slack endpoint often. It checks for new commands. It also reads Ethereum smart contracts. These actions happen every few seconds.
The payload decrypts specific data. It runs Go or JavaScript code. The exact tasks remain unknown. The encryption is asymmetric.
