Security researchers have identified a campaign in which threat actors uploaded malicious Terraform providers and Go modules to the HashiCorp provider registry and Go module proxy, respectively. The actors leveraged these trusted channels to distribute Go-based malware targeting container environments and orchestration platforms. This marks the first observed use of the HashiCorp registry as a distribution vector for malicious payloads, exploiting the trust users place in officially indexed providers and modules.

Which products are affected?

Terraform, Go Modules, gocommunity-io/dockerd, kreuzwenker

What should defenders do?

Users should immediately remove any references to the malicious providers gocommunity-io/dockerd and kreuzwenker/ from their Terraform configurations. Pin provider and module versions in lock files. Verify provider sources against official documentation. Monitor Terraform and Go module logs for unexpected installations. HashiCorp has removed the malicious entries, but residual risk remains if versions were already downloaded.

highMalware

Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry

Researchers identify two compromised providers delivering payloads to system containers and Kubernetes environments

CyberIntel DeskPublished 6 days agoUpdated less than a minute ago1 min read

Malicious Terraform Providers Distribute Go Malware via HashiCorp Registry

Key Takeaways

Threat actors have for the first time used the HashiCorp provider registry to distribute malicious Terraform providers and Go modules.
Two malicious providers and two Go modules were identified, with the providers targeting container and orchestration environments.
The attack exploits the trust users place in officially indexed infrastructure-as-code components.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read