Graphalgo campaign spreads to Terraform providers and Go Modules

A sophisticated supply-chain campaign distributed a Go-based RAT through two malicious Terraform providers (gocommunity-io/dockerd and kreuzwenker/docker) and two Go modules (gocommunity.io/orderedbtree and gogets.dev/btreex). The malware uses targeted activation conditions and AES-encrypted payloads, then runs a second-stage agent that performs system reconnaissance and communicates via encrypted Slack channels and an Ethereum (Arbitrum Sepolia) smart contract dead drop; the report includes IoCs (package names, file hashes, domains, public key, Slack workspaces), GitHub infrastructure used by the actor, victim telemetry, and remediation recommendations.