Coder Registry Compromise: Malicious Server Added to Cloudflare Pool to Distribute Malicious Terraform Modules

1. Basic Information

• Article Title: Coder's registry infrastructure compromised to push malicious modules
• Publisher: BleepingComputer
• Publication Date: 2026-09-03
• Original Source: BleepingComputer
• Related Information Source: Coder security advisory GHSA-vx42-ghc9-gw65
• Related Malware, Threat Actors, CVEs, Products: malicious Terraform module, Coder, registry.coder.com, Cloudflare, Terraform
• Severity: Critical
• Review Update: 2026-09-05 Content Review: Updated details on malicious code functionality and successful exfiltration, secret exposure based on execution conditions, scope of investigation regarding HTTP and post-distribution phases, scope of the vendor's explanation, and fixed Japanese terminology. Updated "Victim/Administrator Perspective" to describe observable events in screens, logs, and devices along with their observation conditions. Clearly stated "Impact on SOCs" as an analysis, organizing lessons learned from the incident in a clear and concise manner.

2. Executive Summary

An attacker modified Coder's Cloudflare configuration and redirected some registry requests to malicious Terraform modules. Organizations must investigate the retrieval and execution of targeted modules, clear affected caches, and rotate any secrets that were accessible from the execution environment.

3. Attack Flow

From Unauthorized Addition of Destinations to Malicious Module Execution

1. An attacker gains access to modify Coder's Cloudflare configuration. The initial access method remains unconfirmed.
2. The attacker adds unauthorized IP addresses to the destination servers for the module registry.
3. Some registry requests are forwarded to the unauthorized servers, distributing Terraform modules that contain malicious code.
4. Affected Coder environments retrieve the malicious module. If caching is enabled, stored modules may also be used at a later time.
5. The malicious code can run in the provisioner during template import, updates, dry runs, or workspace provisioning.
6. The malicious code is designed to search for available credentials in the execution environment and send them to servers at coder-infra[.]com. Successful transmission in each environment must be verified separately.

4. Attacker Position and Execution Location

• An external attacker who gained the access required to modify Coder's Cloudflare configuration.
• Without directly connecting to the victim environment, the attacker causes the victim environment's provisioner to execute code retrieved via a trusted registry.

5. Victim and Administrator Perspective

Victims

• Inference: The process resembles normal workspace creation or template updates, making it difficult to recognize the execution of malicious modules.

Administrators

• Provisioner job logs (provisioner_job_logs.output) may contain the string data.external.telemetry. The official Coder advisory also provides SQL queries to search for this string.
• Inference: If DNS or proxies log network traffic, queries or HTTP/HTTPS connections to coder-infra[.]com or www[.]coder-infra[.]com may appear. HTTP requests may include /cli/check. Query or connection logs alone do not indicate successful credential exfiltration.
• Inference: Modules retrieved during the target time window, along with the template versions and workspace provisioning jobs referencing them, may remain in Coder's stored data. Retrieval timestamps alone do not confirm that a module was malicious.
• Inference: If credentials are later misused, unusual sources or operations may appear in audit logs for cloud, CI/CD, or AI APIs.

6. Success and Failure Conditions

Success Conditions

• Actually retrieving a malicious module from registry.coder.com during the target time window. Because legitimate modules were also distributed to some users, time windows alone are insufficient for confirmation.
• The malicious module executes during template import, updates, dry runs, or workspace provisioning. Execution after the time window due to caching is also subject to investigation.
• Secret exfiltration requires the provisioner to read the target information and successfully transmit it externally.

Failure Conditions / Risk Mitigation

• Clear the affected module cache and re-retrieve verified distributions.
• Check and clear the cache, then update Coder to the patched version. Do not conclude impact assessment based solely on the update.
• Inference: Limit blast radius by applying the principle of least privilege to provisioners, using short-lived credentials, and enforcing outbound traffic allowlists.

7. What Happens Upon Success

• When the malicious module runs, secrets in the provisioner's process environment, configuration files, or terminal command history may be exposed.
• During template imports, updates, or dry runs, user secrets are not passed; instead, the provisioner's own information is targeted. During workspace provisioning, additional data is passed, including user OIDC tokens, configured SSH keys, and external authentication tokens for the target template. External authentication refresh tokens are not included.
• Coder states that in configurations where the provisioner runs within the same service as coderd, Coder configuration data such as database passwords and external authentication settings may also have been exposed.
• Inference: Misuse of stolen credentials could lead to broader compromise of development and cloud environments, or re-execution of malicious code via remaining caches.

8. Observable Logs

• Email: None.
• Proxy/SWG/DNS: Retrieval from registry.coder.com and DNS/HTTP/HTTPS traffic to coder-infra[.]com and www[.]coder-infra[.]com. Include HTTP requests to /cli/check as specified in the official IOCs. Queries or connections alone do not confirm successful exfiltration.
• Endpoint/EDR: Inference: Verify access by Terraform and provisioners to process environments, configuration files, and terminal command histories, as well as the execution of malicious scripts and external transmissions.
• Identity/IdP: Inference: Check for unauthorized use and authentication results regarding potentially exposed OIDC tokens, SSH keys, and cloud/CI/CD credentials.
• SaaS/Cloud (Organization Side): Coder template import, update, dry run, and workspace provisioning logs, as well as module contents and digests.
• SaaS/Cloud (Vendor Side): Cloudflare destination change history. Typically not logs that tenant organizations can retrieve directly; treat as vendor investigation data.
• Network: Outbound DNS, HTTP, TLS, and VPC Flow Logs. Investigate traffic not only during the distribution window, but also until the final use of the targeted cache.

9. Determining Attack Success

The following criteria are used to investigate individual environments and do not imply that success at all stages was observed in the article.

• Attack Attempt Observed (Success Unconfirmed): Retrieving modules from the registry during the target time window only flags potential impact. Even if retrieval of a malicious module is confirmed, successful execution or data exfiltration remains unconfirmed.
• User Activity Confirmed: Confirm the start of template imports, updates, dry runs, or workspace provisioning. This alone does not confirm malicious module execution.
• Initial Execution Confirmed: Confirm the execution of scripts or other actions launched by the malicious module. Check the processing logic and execution results, not just the string data.external.telemetry.
• Malware Execution or Authentication Success Confirmed: Confirm credential harvesting by the malicious code in the provisioner via execution logs. For subsequent authentication, separately verify unauthorized authentication success by the attacker.
• Data Exfiltration or Session Compromise Confirmed: Confirm external transmission of data containing credentials, or session compromise using stolen tokens. DNS queries, connection attempts, or established connections do not confirm this stage.
• Subsequent Compromise Confirmed: Confirm unauthorized actions or lateral movement in cloud, CI/CD, or AI environments using stolen credentials.

10. Investigation Playbook

Inference: Investigation proposals based on article observations and functional descriptions.

• Trigger: Module retrieval during the target time window, traffic to coder-infra[.]com, and logs containing data.external.telemetry.
• Initial Check: Preserve Coder version, templates, caches, module contents, workspace provisioning history, and communication logs. Use the SQL queries from the official advisory to extract potential impact candidates, and do not judge exfiltration as successful based on query results alone.
• Endpoint: Inspect provisioner processes, environment and file access, command histories, and caches. Also check derivative workspace build history and credentials used within them.
• Authentication / Cloud: Determine whether operations involved templates or workspace provisioning, and whether coderd was co-located. Narrow down exposure candidates across cloud, AI, CI/CD, OIDC, SSH, and databases, and examine usage history.
• Subsequent Activity: Track unauthorized resource creation, pipeline modifications, public distribution of artifacts, AI API usage, and SSH logins.
• Containment: Preserve evidence, clear and re-retrieve affected caches, and update Coder. Block traffic destined for the attacker and proactively rotate credentials that were accessible in the execution environment.
• Classification Categories: Differentiate between time-based impact candidates, malicious module retrieval/storage, execution, credential access, successful transmission, and subsequent unauthorized use.

11. Defense and Detection Ideas

Inference: The following are deployment proposals for operations. Do not confirm successful compromise based solely on individual logs or matching IOCs.

• Single Event: Traffic directed toward coder-infra[.]com.
• Single Event: Provisioner logs containing data.external.telemetry. Use both as investigation clues to check contents and execution results.
• Time-Series Correlation: Correlate registry retrieval -> template operations/workspace provisioning -> access to secrets -> external transmission -> unauthorized credential use.
• Hunting: Enumerate modules retrieved between August 31, 07:35 and 21:45 UTC and derived workspaces using official SQL queries and logs, tracking cache usage and external transmission even after distribution has ended.
• Log Gaps: Without module contents/digests, provisioner execution logs, and external transmission details, it is difficult to distinguish between retrieval, execution, and successful exfiltration. Treat Cloudflare configuration changes as vendor-side investigation data.
• Priority Mitigations: Clear and re-retrieve affected caches, apply patched versions, and rotate credentials based on execution conditions as a unified response.

12. Facts / Inference / Hypothesis

Facts

• Coder announced that an attacker accessed the company's Cloudflare infrastructure and added unauthorized IP addresses to the destination servers for the module registry.
• Some requests were forwarded to unauthorized servers, distributing Terraform modules containing malicious code.
• The distribution time window provided by Coder is August 31, 2026, 07:35 to 21:45 UTC.
• The malicious code was designed to search for credentials and transmit them to the attacker's server. Organizations must individually confirm whether retrieval, execution, or exfiltration occurred.
• Potentially exposed information varies by execution condition. Template operations target the provisioner's own secrets; workspace provisioning additionally targets user OIDC tokens; and co-located coderd configurations may target database passwords and similar data.
• Coder lists versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 as patched releases, recommending the clearance of affected caches and proactive rotation of credentials that were accessible.
• Coder stated that there is no information indicating an impact on customer data held by Coder. This statement does not mean customers' own Coder environments are unaffected.
• Because Coder does not manage the attacker's servers and cannot identify affected users, the company requests individual investigations by tenant organizations.

Inference

• Merely allowing TLS connections to legitimate domains does not prevent malicious distributions when delivery destination configurations are compromised. The origin and digests of distributed items must be verified independently using trusted information.
• Environments created from templates that retrieved the targeted modules must also be investigated to track cache persistence and reuse. Do not limit investigations solely to endpoints or distribution time windows where modules were retrieved.

Hypothesis

No additional hypotheses. Unconfirmed items are noted under "Unknowns and Further Investigation."

13. MITRE ATT&CK Mapping

• T1195.002 Supply Chain Compromise: Compromise Software Supply Chain (High): Insertion of malicious Terraform modules into a trusted registry's distribution pipeline.
• T1552.001 Unsecured Credentials: Credentials In Files (High): Corresponds to malicious code searching for secrets within configuration files or command histories. Does not indicate successful exfiltration in every environment.
• T1041 Exfiltration Over C2 Channel (Medium): Candidate corresponding to the function transmitting credentials to an attacker server. Successful transmission in each environment and the use of the communication channel as C2 must be verified separately.

14. Unknowns and Further Investigation

• Total number of organizations and environments that actually retrieved and executed the malicious module, along with the successful scope of credential exfiltration.
• The initial access method used to gain Cloudflare configuration modification privileges.
• The existence of any malicious modules or additional payloads other than those listed in the official advisory.

15. Impact on SOCs and Organizations

In this incident, malicious modules were distributed via registry.coder.com. Even in local Coder environments, organizations must not assume safety based solely on the retrieval destination; it is important to trace retrieve contents during the target time window, as well as template versions, caches, and derived workspaces.

Considering cache reuse, broaden external transmission investigations until the final use of the cache. Verify HTTP traffic to coder-infra[.]com and www[.]coder-infra[.]com, and proactively rotate credentials that were accessible under each execution condition.

16. Audience-Specific Summaries

• For SOCs: Evaluate module retrieval, data.external.telemetry, malicious code execution, external transmission, and unauthorized credential use separately. Also investigate periods when caches remained active.
• For Administrators: Identify affected caches and templates using official procedures, perform cache clearance, updates, and re-retrieval, and rotate secrets that were accessible in the execution environment.
• For Users: If affected workspaces may have been used, follow administrative guidance regarding SSH key rotation and the revocation of OIDC tokens.