Backdoored Terraform module spawning dlp.sh/dlp-docker.sh via terraform init/app

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects Terraform processes (init or apply) executed in conjunction with suspicious post-deployment indicators, such as references to '.terraform' folders, execution of automation scripts like 'dlp.sh' or 'dlp-docker.sh', or access to sensitive telemetry data external to typical infrastructure management.