Security researchers have found Graphalgo-linked malware in two Terraform providers and two Go modules. The campaign extends a threat previously seen in npm packages and uses hidden triggers to keep the malware inactive during ordinary use.
Aikido Security says this is the first systematic malware distribution through Terraform providers it has observed. The affected Terraform providers are gocommunity-io/dockerd and kreuzwenker/docker. The second name closely resembles the legitimate kreuzwerker/docker provider.
The affected Go modules are gocommunity.io/orderedbtree and gogets.dev/btreex. Aikido advises treating any version of these four packages as an indicator of compromise.
Graphalgo Malware Poisons Terraform Go
The malicious Terraform providers contain added code in internal/provider/resource_docker_container_funcs.go. It runs only when the SHA-256 hash of two Terraform values, containerName and networkID, matches a hardcoded value.
If the check succeeds, the code decrypts files hidden in an archive disguised as import-resource.sqlite3, then launches a second-stage Go program with a detached go run . command. This narrow trigger may help the package evade testing while targeting a chosen user.
The Go modules use different packaging. gocommunity.io/orderedbtree contains the malware in readable form.
gogets.dev/btreex hides it in an archive disguised as btreex.sql and activates only when it processes an object with a specific price value. Aikido also found forged commits that made the btreex repository appear older than it was.
Once active, the second-stage remote-access trojan collects details such as the operating system, hostname and username. It checks whether Node.js is available and sends an initial report through Slack.
The malware then uses encrypted communications over both Slack and a smart contract on the Arbitrum Sepolia test network.
It checks the blockchain for instructions every three seconds and Slack every 10 seconds. Commands can tell it to run additional Go or JavaScript code or delete itself.
Aikido linked the Go malware to Graphalgo through shared Slack and blockchain infrastructure and a public key also found in malicious npm payloads.
ReversingLabs first reported the wider Graphalgo campaign in February 2026. The operators also set up gocommunity[.]io and gogets[.]dev as apparent Go package websites, likely to make the malicious modules look credible.
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| Terraform provider | gocommunity-io/dockerd | Malicious provider |
| Terraform provider | kreuzwenker/docker |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
