Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
The Hacker News published a report titled "Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry." The source states that attackers are using malicious Terraform providers to deliver Go malware, and that the delivery occurs via the HashiCorp Registry. In this account, the Terraform provider ecosystem and the registry that hosts providers are the mechanism by which the Go malware is distributed. The provided source text does not identify the specific malicious providers, the names or versions of the affected packages, the malware family, or any command-and-control infrastructure. It also does not state how many providers were involved, when they were published, whether they have been removed, or which users or organizations were affected. No indicators of compromise, file hashes, or detection guidance are included. The excerpt contains no statement about HashiCorp's response or any remediation status. Because the source is limited to the headline and framing, the digest is restricted to what is explicitly reported: malicious Terraform providers were used as a delivery channel for Go malware through the HashiCorp Registry.
The report indicates that the HashiCorp Registry, a common source of Terraform providers for developers, has been used as a channel to deliver Go malware.