Act
active
Malicious Terraform Providers Deliver Go Malware via HashiCorp Registry
- Engineer — Act: First documented weaponization of the HashiCorp Terraform registry as a malware distribution vector directly affects IaC pipelines. Audit all Terraform provider lockfiles and go.sum entries for gocommunity-io/dockerd and the kreuzwenker-prefixed module, and check CI/CD artifact logs for downloads of either package.
- SOC/IR — Plan: No published IOCs or TTPs beyond package names, but this technique warrants building detection for anomalous Terraform provider fetches in CI/CD telemetry; add queries against build logs for downloads of the named providers and alert on new or unrecognized provider sources in IaC pipeline runs.
- Leader — Learn: This marks the first recorded use of HashiCorp’s centralized registry as a malware delivery channel, expanding the trusted-tooling supply chain threat surface; useful context for updating third-party software sourcing policies and vendor risk discussions, but download counts are low and there is no systemic breach requiring immediate leadership action.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.