tag: Terraform · 2 items
- Engineer — Act: First documented weaponization of the HashiCorp Terraform registry as a malware distribution vector directly affects IaC pipelines. Audit all Terraform provider lockfiles and go.sum entries for gocommunity-io/dockerd and the kreuzwenker-prefixed module, and check CI/CD artifact logs for downloads of either package.
- SOC/IR — Plan: No published IOCs or TTPs beyond package names, but this technique warrants building detection for anomalous Terraform provider fetches in CI/CD telemetry; add queries against build logs for downloads of the named providers and alert on new or unrecognized provider sources in IaC pipeline runs.
- Leader — Learn: This marks the first recorded use of HashiCorp’s centralized registry as a malware delivery channel, expanding the trusted-tooling supply chain threat surface; useful context for updating third-party software sourcing policies and vendor risk discussions, but download counts are low and there is no systemic breach requiring immediate leadership action.
Act
archived
Coder registry infrastructure compromised via Cloudflare to deliver malicious Terraform modules
- Engineer — Act: If your teams use Coder’s Terraform registry, audit your module sources immediately and rotate any cloud credentials (AWS keys, GCP SAs, Azure SPNs) that Terraform may have accessed during runs while the malicious servers were active.
- SOC/IR — Act: Hunt CI/CD and IaC pipeline logs for module fetches from Coder’s registry during the compromise window; look for anomalous outbound credential-exfiltration traffic from Terraform runner environments and trigger an assume-breach sweep if usage is confirmed.
- Leader — Act: Determine whether engineering teams use Coder’s Terraform registry, and if so, request an incident timeline from Coder, assess credential exposure scope, and brief leadership on potential cloud environment impact before it surfaces externally.