hashicorp-terraform[.]ioDomain
Reported by 2 independent sources · first reported by SentinelLabs · last reported
Last reported 16 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware“…sh -c as a detached child process.Creates the lock file to prevent repeated execution.The download URL uses the lookalike domain hashicorp-terraform[.]io and a path resembling a legitimate Terraform plugin metrics endpoint.”
-
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties“hashicorp-terraform[.]io Provider:”
Indicators reported together
named in the same reports- registry.hashicorp-aws[.]comin 1 report
- registry.hashicorp-aws[.]ioin 1 report
- registry.hashicorp-terraform[.]ioin 1 report
- 176.97.114[.]232in 1 report
- 45.11.59[.]140in 1 report
- 85.137.56[.]10in 1 report
- grenight[.]comin 1 report
- 85.137.56[.]245in 1 report
- api.nostr[.]watchin 1 report
- nostr[.]momin 1 report
- relay.snort[.]socialin 1 report
- offchain[.]pubin 1 report
- nostr.oxtr[.]devin 1 report
- nostr[.]winein 1 report
- 1cd6d13ff15adbf7a42025d10ec99b4ain 1 report
- 5728b11d30586bbf…722a06e767a2in 1 report
- 02df07a173ab03b8…fff8b1467f28in 1 report
- c491d477dbe0ae04…144c03f73ec4in 1 report
- technicais.sytes[.]netin 1 report
- storage.hubpage[.]cloudin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.