Coder’s registry infrastructure compromised to push malicious modules

Attackers compromised Coder’s Cloudflare-managed infrastructure to inject unauthorized registry servers, which then served malicious Terraform modules designed to exfiltrate credentials. The attack targeted users pulling modules from Coder’s registry, effectively weaponizing the supply chain.

Technical Breakdown – TTPs: Supply chain compromise via infrastructure takeover (T1195.001), rogue registry injection (T1554), credential theft via malicious module code (T1552). – IOCs: No specific IPs or hashes disclosed in the report; the attack vector was unauthorized registry servers added to Coder’s Cloudflare configuration. – Affected: Coder’s Terraform module registry; users who pulled modules during the compromise window.

Defense – Pin module versions and verify checksums before applying infrastructure-as-code. – Monitor for unexpected registry endpoints in your Terraform provider configuration. – Enable Cloudflare audit logs and review any unauthorized changes to DNS or proxy settings.

Source: https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/