Malicious Terraform Providers on HashiCorp Registry Deliver Go Malware — Detection and Supply Chain Remediation Guide

---
title: Terraform Process Spawning Suspicious Child Process
id: 3f9a1b72-6c4e-4d21-9a8b-5e7c2d40f1a9
status: experimental
description: Detects the terraform binary spawning shells, script interpreters, or download utilities. Malicious Terraform providers executing payloads during plan/apply often launch child processes outside normal provider gRPC behavior.
references:
  - https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html
  - https://attack.mitre.org/techniques/T1195/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.supply_chain_compromise
  - attack.t1195.001
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\terraform.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Terraform external data sources or local-exec provisioners intentionally invoking scripts
level: high
---
title: Malicious Go Module or Terraform Provider Package Reference
id: 8c2e4d19-1a5b-4f67-b3d2-9f0e6a21c7b4
status: experimental
description: Detects references to known malicious package identifiers disclosed in the Aikido research, including the gocommunity-io/dockerd Go module and the abused kreuzwenker Terraform provider namespace, in process command lines or file content tooling.
references:
  - https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.supply_chain_compromise
  - attack.t1195.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'gocommunity-io/dockerd'
      - 'kreuzwenker'
  condition: selection
falsepositives:
  - The legitimate kreuzwenker/docker provider may be in authorized use; verify provider source registry and lock file hashes before treating as benign
level: high
---
title: Terraform Provider Plugin Execution From Nonstandard Path
id: 5b1d7e36-8f42-4a90-c6e1-2d8b9f03a5c7
status: experimental
description: Detects execution of executables with terraform-provider naming conventions from user-writable or temporary directories rather than the standard .terraform/providers or plugin cache paths, a pattern consistent with dropped second-stage Go payloads.
references:
  - https://thehackernews.com/2026/09/attackers-use-malicious-terraform.html
  - https://attack.mitre.org/techniques/T1195/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.supply_chain_compromise
  - attack.t1195.001
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains: 'terraform-provider'
  filter_legit:
    Image|contains:
      - '\.terraform\providers\'
      - '\terraform.d\plugin-cache\'
      - '\.terraform.d\'
  condition: selection_name and not filter_legit
falsepositives:
  - Custom-built providers under development executed from GOPATH or build directories
level: medium

// Hunt 1: Terraform spawning suspicious child processes (endpoints + CI runners with MDE)
let suspiciousChildren = dynamic(["powershell.exe","pwsh.exe","cmd.exe","curl.exe","wget.exe","mshta.exe","rundll32.exe","bash","sh","python","python3"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has "terraform" or FileName has "terraform"
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: Any reference to the disclosed malicious packages across process and command telemetry
union DeviceProcessEvents, DeviceFileEvents, DeviceImageLoadEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("gocommunity-io/dockerd", "kreuzwenker")
   or FileName has_any ("gocommunity-io", "dockerd")
   or FolderPath has "gocommunity-io"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, SHA256;

// Hunt 3: Terraform provider binaries making unexpected outbound network connections
// (Linux CI runners forwarded via Syslog/CEF, or MDE network events)
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has "terraform-provider" or InitiatingProcessFileName =~ "terraform"
| where not (RemoteUrl has_any ("amazonaws.com","azure.com","microsoftonline.com","googleapis.com","cloudflare.com","releases.hashicorp.com","registry.terraform.io","checkpoint-api.hashicorp.com"))
| summarize Connections=count(), UniqueDestinations=dcount(RemoteIP), Destinations=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Connections desc;

// Hunt 4: Syslog-ingested Linux runners — go toolchain fetching modules then spawning shells
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName has_any ("go", "terraform")
| where SyslogMessage has_any ("gocommunity-io", "/bin/sh -c", "/bin/bash -c")
| project TimeGenerated, Computer, ProcessName, SyslogMessage;

-- Hunt: Rogue Terraform provider binaries and references to malicious packages
-- Searches plugin directories for recently created executables and enumerates
-- terraform/go child processes and outbound connections.

-- 1. Recently written executables in Terraform provider/plugin paths
SELECT FullPath, Size, Mtime, Ctime,
       hash(path=FullPath) AS Hash
FROM glob(globs=[
  'C:/Users/*/.terraform.d/**/*',
  'C:/Users/*/go/pkg/mod/github.com/gocommunity-io*/**',
  '/home/*/.terraform.d/**/*',
  '/root/.terraform.d/**/*',
  '/home/*/go/pkg/mod/github.com/gocommunity-io*/**',
  '/root/go/pkg/mod/github.com/gocommunity-io*/**',
  '**/.terraform/providers/**/*.exe'
])
WHERE NOT IsDir
  AND Mtime > now() - 60 * 24 * 3600
ORDER BY Mtime DESC

-- 2. Live processes: terraform or go spawning interpreters, plus their network connections
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)terraform|go(\.exe)?$|dockerd'
   AND CommandLine =~ '(?i)kreuzwenker|gocommunity-io')
   OR (Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)terraform')
       AND Name =~ '(?i)powershell|cmd|bash|sh|python|curl|wget')

-- 3. Outbound connections from terraform/provider processes (exfil / C2 check)
SELECT Pid, Name, ProcessName, DestIP, DestPort, Status
FROM netstat()
WHERE ProcessName =~ '(?i)terraform|dockerd|gocommunity'
  AND Status =~ 'ESTAB'
  AND DestIP !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

#!/usr/bin/env bash
# audit-terraform-go-supplychain.sh
# Audits Terraform configs/lock files and Go modules for the malicious packages
# disclosed by Aikido (Sept 2026). Run at repo root or against a build agent.

set -euo pipefail
FOUND=0

MALICIOUS_PATTERNS=(
  "gocommunity-io/dockerd"
  "gocommunity-io"
)

echo "=== [1/4] Scanning Terraform configurations and lock files ==="
for pat in "${MALICIOUS_PATTERNS[@]}" "kreuzwenker"; do
  if grep -rIn --include='*.tf' --include='.terraform.lock.hcl' "$pat" . 2>/dev/null; then
    echo "[ALERT] Suspicious reference found: $pat"
    FOUND=1
  fi
done

echo "=== [2/4] Scanning Go module files ==="
if grep -rIn --include='go.mod' --include='go.sum' "gocommunity-io" . 2>/dev/null; then
  echo "[ALERT] Malicious Go module reference in go.mod/go.sum"
  FOUND=1
fi

echo "=== [3/4] Checking Go module cache for malicious modules ==="
GOMODCACHE=$(go env GOMODCACHE 2>/dev/null || echo "")
if [[ -n "$GOMODCACHE" && -d "$GOMODCACHE" ]]; then
  if ls "$GOMODCACHE"/github.com/ 2>/dev/null | grep -i "gocommunity-io"; then
    echo "[ALERT] Malicious module present in local Go module cache — purge and investigate host"
    FOUND=1
  fi
fi

echo "=== [4/4] Listing all community (non-hashicorp/non-official) providers in use ==="
grep -rhA2 'required_providers' --include='*.tf' . 2>/dev/null | \
  grep -E 'source\s*=' | sort -u | grep -vE 'hashicorp/|integrations/github|terraform-aws-modules' || \
  echo "No non-official provider sources detected (verify manually)."

echo ""
echo "=== Provider verification status ==="
find . -name '.terraform.lock.hcl' -exec sh -c 'echo "--- {} ---"; grep -E "^provider|^  \"registry" {} | head -40' \; 2>/dev/null || true

if [[ $FOUND -eq 1 ]]; then
  echo ""
  echo "!!! MALICIOUS PACKAGE INDICATORS FOUND — ISOLATE HOST, ROTATE ANY CLOUD CREDENTIALS USED BY THIS PIPELINE, AND OPEN AN IR CASE !!!"
  exit 2
else
  echo ""
  echo "No indicators of the disclosed malicious packages found. Continue with hardening steps in the accompanying advisory."
  exit 0
fi

# Audit-TerraformSupplyChain.ps1 — run at repo root or against an agent
$ErrorActionPreference = 'SilentlyContinue'
$found = $false

Write-Host '=== [1/3] Scanning Terraform and Go files for malicious package references ==='
$hits = Get-ChildItem -Recurse -Include *.tf,.terraform.lock.hcl,go.mod,go.sum |
        Select-String -Pattern 'gocommunity-io','gocommunity-io/dockerd','kreuzwenker'
if ($hits) { $hits | Format-Table Path, LineNumber, Line -AutoSize; $found = $true }

Write-Host '=== [2/3] Checking Go module cache ==='
$modCache = (& go env GOMODCACHE) 2>$null
if ($modCache -and (Test-Path "$modCache\github.com")) {
    Get-ChildItem "$modCache\github.com" -Directory |
        Where-Object Name -match 'gocommunity-io' |
        ForEach-Object { Write-Host "[ALERT] Malicious module cached: $($_.FullName)"; $script:found = $true }
}

Write-Host '=== [3/3] Enumerating non-HashiCorp provider sources ==='
Get-ChildItem -Recurse -Filter *.tf |
    Select-String -Pattern 'source\s*=\s*"' |
    Where-Object { $_.Line -notmatch 'hashicorp/' } |
    Select-Object Path, Line -Unique | Format-Table -AutoSize

if ($found) {
    Write-Host '`n!!! INDICATORS FOUND — isolate host, rotate pipeline cloud credentials, open IR case !!!' -ForegroundColor Red
    exit 2
} else {
    Write-Host '`nNo disclosed malicious package indicators found.' -ForegroundColor Green
    exit 0
}