MalwareUsed by 2 actors

Graphalgo

Graphalgo is a recruitment-themed software supply-chain malware campaign and remote-access trojan ecosystem attributed with medium-to-high confidence to the North Korea-linked Lazarus Group. It targets JavaScript, Python, Go, and DevOps practitioners, particularly those working in blockchain and cryptocurrency sectors. Operators use fake recruiter personas, fraudulent companies, job advertisements, and coding assessments to induce candidates to run projects that install malicious dependencies from public package registries. Malicious packages have also been distributed through Go modules and typosquatted Terraform providers. The payloads deploy remote-access trojans capable of collecting host and system information, enumerating processes, files, and directories, executing arbitrary commands and additional code, manipulating files, and uploading or downloading data. Graphalgo checks for cryptocurrency-wallet browser extensions, consistent with a financial-theft objective. Go variants use encrypted dual command-and-control channels involving Slack and blockchain-based dead drops, with per-victim cryptographic key material; they can execute Go or JavaScript code and remove themselves on command. Observed infections include Windows, Linux, and macOS systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

North Korea’s Lazarus Group has maintained a sustained presence in PyPI and npm targeting AI and developer tool packages under the campaign codenamed “Graphalgo.”

via cloud security alliancelabs.cloudsecurityalliance.org

TraderTraitor

The coordinated campaign has been codenamed graphalgo in reference to the first package published in the npm registry... The packages ultimately act as a conduit to deploy a remote access trojan (RAT) that periodically fetches and executes commands from an external server.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1583.001DomainsEvidence1

Both of the threat actor-controlled GitHub organizations have companion websites purporting to be new Go package ecosystems, gogets[.]dev and gocommunity[.]io. Both domains were registered within one day of the threat actor-controlled GitHub organizations.

T1585.001Social Media AccountsEvidence1

The following GitHub accounts and organizations were used to support this activity... the threat actor periodically cleans up its malware on GitHub, likely to prolong the lifespan of GitHub accounts.

Initial Access

4 techniques

T1195Supply Chain CompromiseEvidence1

Instead of direct attachments, attackers embed malicious dependencies inside packages on popular developer registries — npm and PyPI. When candidates run or debug the code as part of the “interview exercise,” these hidden packages install a remote access trojan (RAT) on their machine.

T1195.001Compromise Software Dependencies and Development ToolsEvidence2

T1195.002Compromise Software Supply ChainEvidence1

Go malware [was] distributed via at least two Terraform providers and at least two Go Modules.

T1566.003Spearphishing via ServiceEvidence1

“The attack begins on social platforms like LinkedIn, Facebook, and even Reddit, where developers are approached with job opportunities…”

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

[The malware] executes the decrypted code as a Go package using a detached go run command. Decrypted C2 messages contain a header that tells the malware to execute the body as additional Go or JavaScript code (via node).

T1204User ExecutionEvidence1

When candidates run or debug the code as part of the “interview exercise,” these hidden packages install a remote access trojan (RAT) on their machine.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The SHA256 hash is used as an AES key to decrypt a file path from within the package. The malware unzips the archive contents, AES decrypts each contained file.

T1036.005Match Legitimate Resource Name or LocationEvidence1

kreuzwenker/docker [is] a typosquat of the popular kreuzwerker/docker Terraform provider.

T1070.004File DeletionEvidence1

Decrypted C2 messages contain a header that tells the malware to execute the body as additional Go or JavaScript code ... or to self-delete.

T1070.006TimestompEvidence1

The threat actor used forged commits in the gogets-dev/btreex repository to backdate commits to November 2025. Because Go Modules treats commit dates as authoritative, the Go module proxy and pkg.go.dev display the falsified release date.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The malware initially gathers system information including hardware attributes, OS, hostname, and whether node is available on the infected system.

T1518Software DiscoveryEvidence1

Once installed, the RAT can: • Check for browser crypto extensions like MetaMask — a strong signal the motivation includes cryptocurrency theft.

Command and Control

4 techniques

T1102Web ServiceEvidence1

“The malicious functionality is hidden using several layers of indirection across public services which include GitHub, npm and PyPI…”

T1102.001Dead Drop ResolverEvidence1

For blockchain-based C2, the malware retrieves data from an Ethereum smart contract on the Arbitrum Sepolia testnet ... [and] reads encrypted commands from serviceData1 and serviceData2.

T1102.002Bidirectional CommunicationEvidence1

The second-stage RAT is a Go agent with dual command-and-control channels, using blockchain dead drops and a Slack bot token.

T1573Encrypted ChannelEvidence1

The malware generates shared keys by combining its ephemeral key with two threat actor public keys... all communication is encrypted using the shared key.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Once installed, the RAT can: • Exfiltrate files and data

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 days ago

hash.sha1●●●●●●●●●●●●View more in app10 days ago

hash.sha256●●●●●●●●●●●●View more in app10 days ago

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

aikido dev blogNews

Sep 22, 2026

Graphalgo Malware Spreads to Terraform and Go

A targeted, multi-stage supply-chain malware family distributed through malicious NPM packages, Go modules, and Terraform providers. Its Go variant conditionally decrypts and launches a second-stage Go RAT, fingerprints the host, reports via Slack, and receives encrypted commands through Slack and an Ethereum/Arbitrum Sepolia blockchain dead drop. Commands can execute additional Go or JavaScript code or self-delete.

security affairsNews

Feb 15, 2026

Malicious npm and PyPI packages Llinked to Lazarus APT fake recruiter campaign

A Lazarus-linked fake recruiter/software supply chain campaign using malicious npm and PyPI dependencies embedded in “job interview” GitHub projects. When executed, the dependencies run a multi-stage, modular infection chain that ultimately downloads a RAT with file access, command execution, and process control; it also checks for crypto wallets (e.g., MetaMask) and uses token-protected C2.

security online infoNews

Feb 13, 2026

Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware

Post navigation Previous: Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware

security online infoNews

Feb 13, 2026

The Human Hack: LummaStealer Returns with Deceptive "ClickFix" Attacks

“Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with ‘Graphalgo’ Malware”

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Graphalgo