Malicious Terraform Providers Deliver Go Malware via HashiCorp Registry

Thu, 24 Sep 2026 15:49:46 +0000

Engineer — Act: First documented weaponization of the HashiCorp Terraform registry as a malware distribution vector directly affects IaC pipelines. Audit all Terraform provider lockfiles and go.sum entries for gocommunity-io/dockerd and the kreuzwenker-prefixed module, and check CI/CD artifact logs for downloads of either package.
SOC/IR — Plan: No published IOCs or TTPs beyond package names, but this technique warrants building detection for anomalous Terraform provider fetches in CI/CD telemetry; add queries against build logs for downloads of the named providers and alert on new or unrecognized provider sources in IaC pipeline runs.
Leader — Learn: This marks the first recorded use of HashiCorp’s centralized registry as a malware delivery channel, expanding the trusted-tooling supply chain threat surface; useful context for updating third-party software sourcing policies and vendor risk discussions, but download counts are low and there is no systemic breach requiring immediate leadership action.

Go-Malware on CuraSec