Graphalgo Terraform Malware Targets Cloud Credentials
By Yonatan Hoorizadeh, CISSP, CISM, CRISC, AAISM
Published By: Purple Shield Security
Published: September 23, 2026
Last updated: September 23, 2026
Graphalgo is a malware campaign that Aikido Security found hidden inside two Terraform providers and two Go modules in September 2026. One provider typosquats a Docker provider with 56 million reported downloads. Any machine that installed these packages should be treated as fully compromised, and every cloud credential it held should be rotated.
What is the Graphalgo Terraform provider malware?
The Graphalgo Terraform provider malware is a remote access trojan (RAT) written in Go and hidden inside infrastructure-as-code packages. Aikido Security reported on September 22, 2026 that it found the malware in the Terraform providers gocommunity-io/dockerd and kreuzwenker/docker and in the Go modules gocommunity.io/orderedbtree and gogets.dev/btreex. Once running, the RAT reports back to its operator and waits for commands.
Terraform, the infrastructure-as-code tool from HashiCorp, uses plugins called providers to talk to cloud platforms and services. When an engineer runs terraform init, Terraform downloads the providers the code asks for and runs them locally. A malicious provider therefore executes on the machine of the person deploying your infrastructure, with whatever access that person has.
Aikido researcher Oliver Smith stated the novelty plainly: "This is the first time we've observed malware distributed via Terraform providers." Aikido acknowledged separate research on malicious Terraform providers but said Graphalgo is the first systematic distribution of malware through Terraform it is aware of.
The provider kreuzwenker/docker is a typosquat of kreuzwerker/docker, a widely used Docker provider that Aikido says has 56 million reported downloads. The two names differ by a single letter (an "n" where the "r" belongs). That is exactly the kind of slip a busy engineer makes when adding a provider from memory or from a copied snippet.
Graphalgo itself has been around for months. Aikido links the new Go code to the Graphalgo campaign that ReversingLabs first reported in February 2026, which spread through malicious npm packages. According to Aikido, the Go version shares a public key, Slack infrastructure, and blockchain infrastructure with recent npm samples.
Why are DevOps workstations such a valuable target?
DevOps and platform engineering workstations are valuable targets because they routinely hold the credentials that build and change production. A laptop that runs terraform apply usually has cloud provider keys, Git tokens, SSH keys, and Terraform state files within reach. Compromising that one machine can give an attacker a shorter path to production than attacking the production environment directly.
Aikido made the same point in its report. Developer machines are always attractive to attackers, but Terraform users are more likely to be deploying infrastructure, which gives an attacker a more direct route to critical production credentials.
Most asset inventories don't reflect that reality. Companies tend to classify endpoints by device type or department, so a DevOps engineer's MacBook sits in the same tier as a sales rep's. In practice, a laptop that can deploy to production belongs with your domain controllers and cloud root accounts: a tier 0 asset whose compromise equals compromise of everything it can deploy.
The Graphalgo victim data points the same direction. Aikido found 18 unique hostnames across 725 plaintext check-in messages in the attacker's Slack channel, with 10 on macOS, 5 on Linux, and 3 on Windows. A skew toward macOS and Linux is consistent with engineering laptops and build hosts rather than the Windows-heavy profile of a typical office-worker infection.
How does the Graphalgo malware avoid detection?
The Graphalgo malware avoids detection through three design choices. It stays dormant unless it sees a specific trigger, it talks to its operator through Slack and a blockchain smart contract instead of an obviously suspicious server, and one module used forged Git commits to fake an older release date. Each choice defeats a shortcut defenders commonly rely on.
It only activates for the intended victim
The malicious Terraform providers stay inert unless two Terraform variables, a container name and a network ID, combine into one specific hashed value. Aikido says that condition keeps the malware harmless except under specific runtime conditions, which points to a targeted attack. When the trigger matches, the provider decrypts a hidden archive disguised as a SQLite file and runs the second stage in the background.
A dormant trigger undermines sandbox testing. A scanner that installs and runs the Graphalgo provider with ordinary inputs sees a normal Docker provider. The attacker apparently knew, or expected to learn, the exact container and network names its target uses, which suggests reconnaissance or social engineering before the package was ever pulled.
It hides its command traffic inside normal services
The second-stage Graphalgo RAT takes commands through two channels: a Slack bot and an Ethereum smart contract on the Arbitrum Sepolia test network, a technique known as a blockchain dead drop. Aikido found the malware polls the blockchain every 3 seconds and Slack every 10 seconds. On command, it can run additional Go or JavaScript code or delete itself.
Slack API traffic is ordinary on most corporate networks, so egress filtering is unlikely to flag the Graphalgo check-ins. Blockchain traffic is less ordinary. Aikido recommends that organizations with no business need to interact with blockchains alert on network connections to HTTP-based blockchain services.
Aikido's analysis shows the Graphalgo command channel is in active use. The attacker's Slack channel held 1,240 encrypted messages dating from July 16, and the smart contract recorded 1,402 transactions going back to August 6.
It fakes its own release history
The Go module gogets.dev/btreex first appeared on September 8, but the attacker forged commits to backdate them to November 2025. Because Go Modules treats commit dates as authoritative, the Go module proxy and pkg.go.dev displayed the fake date, according to Aikido. The attacker also stood up two fake Go package websites, gogets.dev and gocommunity.io, to make its packages look established.
Package age is one of the most common heuristics in software supply chain defense. A rule like "only adopt packages that have been around for a while" fails when the attacker can set the clock on the package's history.
What is your supply chain tooling not watching?
Many software supply chain security tools focus on npm, PyPI, and container images and leave Terraform providers out of scope. Aikido disclosed that its own platform flags the two Graphalgo Go modules but does not yet monitor the Terraform Registry, and said that coverage is coming. If the vendor that found the malware can't see Terraform providers yet, ask whether your vendor can.
Mainstream coverage of supply chain attacks tends to miss this gap. Infrastructure-as-code files get scanned for misconfigurations such as open storage buckets and permissive security groups by cloud security posture management (CSPM) tools. The Terraform providers that execute that code form a separate dependency tree, and few security programs inventory them at all.
Terraform already records provider checksums in a dependency lock file named .terraform.lock.hcl. The lock file protects you from a provider changing underneath you. The lock file does not protect you from the wrong provider being added in the first place, which is how a typosquat like kreuzwenker/docker gets in. That check has to happen in code review, when a person reads the source address in the required_providers block.
How would a vCISO triage Graphalgo in the first 72 hours?
A virtual Chief Information Security Officer (vCISO) would treat Graphalgo as a scoping exercise first and a cleanup second. The first 24 hours answer one question: did any of the four Graphalgo packages ever run on a machine you own, or on a machine that deploys to your cloud? Every later decision depends on that answer.
Hours 0 to 24: search every Terraform repository, lock file, and Go module file (go.mod and go.sum) for the four package names, including repositories owned by contractors. Check CI/CD runners and their caches too. A clean result in your own repositories is not a clean result if a consultant runs Terraform from their own laptop against your AWS account.
Hours 24 to 48: if the search finds a hit, that machine is compromised. Isolate it, then rotate every credential it could reach, starting with cloud and infrastructure credentials, then Git tokens, package publishing tokens, and SSH keys. Aikido warns that the attacker may have acted with valid, working credentials, so treat Terraform applies, commits, and CI runs from the exposure window as potentially hostile until reviewed.
Hours 48 to 72: decide what you owe others. A compromised deployment credential may trigger notice duties under your cyber insurance policy, client contracts, or frameworks like SOC 2, HIPAA, or PCI DSS if the affected cloud account holds regulated data. Insurers generally expect prompt notice, and late notice can complicate a claim, so call your broker early even while facts are still coming in.
Graphalgo is the kind of event where Purple Shield Security's incident response services and vCISO work overlap. The technical cleanup of one laptop takes a day or two. The credential blast radius, contractual notice, and insurance questions are what determine the real cost.
What should your business do?
This week, confirm none of the four Graphalgo packages exist anywhere in your environment, identify everyone inside or outside your company who runs Terraform with production credentials, and shorten how long those credentials live. Those three moves address the Graphalgo campaign specifically and the broader class of attacks aimed at infrastructure tooling.
If your team runs Terraform in-house
Search repositories and lock files for gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree, and gogets.dev/btreex, and block the domains gocommunity.io and gogets.dev at DNS.
Require code review on any change to a required_providers block, with the reviewer confirming the provider namespace against the official Terraform Registry page.
Consider a private registry or provider network mirror so engineers can only install Terraform providers your team has approved.
Replace long-lived cloud access keys on engineer laptops with short-lived credentials issued through single sign-on, and move production applies into CI pipelines that authenticate with OpenID Connect (OIDC) federation instead of stored secrets.
Alert on connections to public blockchain services from engineering endpoints and build runners if you have no business reason to allow them.
Reclassify DevOps and platform engineering laptops as tier 0 assets in your inventory and endpoint detection and response (EDR) policy.
If a contractor or MSP runs Terraform for you
Ask your managed service provider (MSP) or infrastructure contractor three questions in writing. Have they checked their repositories and workstations for the four Graphalgo packages? Do their engineers hold standing credentials to your cloud accounts? Would they tell you within 24 hours if a workstation that touches your environment were compromised? Their answers show whether your cloud security depends on a laptop you have never seen.
Frequently asked questions
How can I tell if my Terraform code uses one of the malicious Graphalgo providers?
Search your Terraform files and .terraform.lock.hcl files for the source addresses gocommunity-io/dockerd and kreuzwenker/docker, and search go.mod and go.sum files for gocommunity.io/orderedbtree and gogets.dev/btreex. Aikido lists every version of these packages as malicious. Check CI/CD runner caches and contractor repositories as well, since a clean main repository doesn't cover them.
Is the legitimate kreuzwerker/docker Terraform provider compromised?
No. Aikido's report identifies kreuzwenker/docker, a typosquat, not the legitimate kreuzwerker/docker provider with 56 million reported downloads. The names differ by one letter, so confirm the namespace character by character. A source address ending in "werker" is the real provider; one ending in "wenker" is the malicious copy.
Is uninstalling the malicious provider enough to clean the machine?
No. The Graphalgo malware launches its second stage as a detached background process, so deleting the provider doesn't stop code that is already running. Aikido advises isolating the machine, rotating every credential that touched it, reviewing activity during the exposure window, and reimaging the device. Reimaging is the only way to be confident the host is clean.
Should we block blockchain traffic on our corporate network?
If your business has no reason to interact with blockchains, alerting on connections to HTTP-based blockchain services is a reasonable first step, and Aikido recommends exactly that. Start with engineering endpoints and build runners, where Graphalgo operates. Move from alerting to blocking once you know what legitimate blockchain traffic, if any, exists in your environment.
If your engineers or contractors deploy to AWS, Azure, or Google Cloud from their laptops, the credentials on those machines deserve the same scrutiny as your production accounts. Purple Shield Security's cloud security consulting can map which workstations hold deployment access, shorten credential lifetimes, and build provider review into your pipeline. Reach out through purpleshieldsecurity.com to talk it through.
