Lazarus Group Graphalgo Campaign Supply Chain Attacks

The Lazarus Group, a North Korean state-sponsored threat actor, has expanded its 'Graphalgo' campaign to target the Go and DevOps ecosystems. For the first time, researchers have observed malicious Terraform providers being distributed via the official HashiCorp Registry, including typosquatted versions of popular docker providers. This evolution demonstrates a strategic shift toward compromising infrastructure-as-code (IaC) tools to gain direct access to production environments and cloud credentials.

The attack typically begins with social engineering, where attackers pose as recruiters from fake Web3 or blockchain companies on platforms like LinkedIn and Reddit. Targets are invited to complete coding tasks that require forking repositories containing malicious dependencies. The resulting malware is a sophisticated Go-based RAT featuring dual command-and-control (C2) channels. It utilizes Slack API endpoints and Ethereum smart contracts on the Arbitrum and Sepolia testnets as decentralized 'dead drops' to receive encrypted commands, making the infrastructure highly resilient to traditional takedown efforts.