Lazarus Group Graphalgo Supply Chain Campaign Targets Go and Terraform

The Lazarus Group (suspected North Korean APT) has expanded its 'Graphalgo' campaign to target the Go and Terraform ecosystems, marking the first recorded instance of systematic malware distribution through Terraform providers. The campaign uses sophisticated social engineering, including fake job recruitment for crypto-themed companies like 'Veltrix Capital,' to lure developers into running malicious code hidden within legitimate-looking software dependencies.

The technical execution is highly modular, featuring multi-stage Remote Access Trojans (RATs) that utilize dual command-and-control (C2) channels. These include Slack API communications and blockchain-based 'dead drops' on the Arbitrum Sepolia testnet. The malware is designed to be inert unless specific runtime conditions (such as specific variable hashes) are met, indicating a highly targeted operational focus. The ultimate goal appears to be the theft of cryptocurrency and production credentials from DevOps workstations.