Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
Overview
Researchers have discovered a new method of distributing Go-based malware through a centralized repository operated by HashiCorp. This marks a significant shift, as attackers are now using Terraform providers and Go modules to deliver malicious payloads. The specific malicious modules identified are 'gocommunity-io/dockerd' and 'kreuzwenker', which have been downloaded a combined total of 222 times. This incident raises concerns about the security of widely used development tools and platforms, as it demonstrates that even trusted repositories can be exploited to spread malware. Developers and organizations need to be vigilant and scrutinize the sources of their dependencies to avoid potential infections.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: gocommunity-io/dockerd, kreuzwenker
- Action Required: Developers should verify the integrity of their Go modules and Terraform providers, and consider using tools to scan for vulnerabilities in dependencies.
- Timeline: Newly disclosed
Original Article Summary
Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of Terraform providers and Go modules is below - gocommunity-io/dockerd (222 downloads) kreuzwenker/
Impact
gocommunity-io/dockerd, kreuzwenker
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Developers should verify the integrity of their Go modules and Terraform providers, and consider using tools to scan for vulnerabilities in dependencies.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware.