Posted on

Coder Registry Supply-Chain Compromise – Malicious Terraform Modules and Credential Theft

Threat Overview

Coder disclosed a critical software-supply-chain incident in which an unidentified attacker gained access to infrastructure behind registry.coder.com and added unauthorized IP addresses to the Cloudflare pool serving Coder’s module registry. Between 07:35 UTC and 21:45 UTC on August 31, 2026, some registry requests were routed to attacker-controlled servers that returned modified Terraform modules containing credential-stealing code.

Coder states that affected modules searched for provisioner environment variables and secrets, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets, terminal history, user OIDC tokens, configured SSH keys, one-time external authentication tokens, and Coder database/configuration secrets when provisioning ran inside coderd. Stolen data was sent to coder-infra.com at 199.91.220.205.

The official advisory provides high-fidelity hashes, dlp.sh/dlp-docker.sh artifacts, and a malicious Terraform data "external" "telemetry" block. Coder states refresh tokens were not passed to the provisioner and it has no indication that customer data maintained by Coder itself was affected. Coder cannot conclusively identify every impacted deployment because attacker-controlled infrastructure handled the malicious traffic.

References

Impacted Systems

  • Vendor/product: Coder self-hosted developer workspace platform and Coder Registry modules.
  • Affected versions: versions before 2.37.0; patched backports 2.36.4, 2.35.7, and 2.34.9.
  • Platform: environments using registry.coder.com as a Terraform module source.
  • Exposure window: August 31, 2026, 07:35 UTC through 21:45 UTC.
  • Trigger conditions: template creation/update/dry run, or workspace creation when Terraform module caching was disabled.
  • Impact: theft of provisioner, cloud, AI, CI/CD, OIDC, SSH, external-auth, database, and configuration secrets.
  • Confirmed domain: coder-infra.com / www.coder-infra.com.
  • Confirmed IP: 199.91.220.205.
  • Confirmed URL: http://www.coder-infra.com/cli/check.
  • Confirmed malicious Terraform pattern: data "external" "telemetry" invoking dlp-docker.sh.

Why This Hunt Was Performed

This is a confirmed software-supply-chain compromise with direct access to high-value developer and cloud credentials.

Criticality

Critical. Coder rates the advisory CVSS 9.0 and confirms delivery of credential-stealing modules through trusted registry infrastructure.

Exploitation Status / Threat Activity

Confirmed malicious supply-chain activity. Attacker-controlled registry servers delivered malicious modules to a subset of users during the exposure window.

Scope and Visibility

All hunting and review statements in this report are limited to telemetry ingested into Microsoft Sentinel and the retention available for those data sources. Absence of matching activity in available Sentinel data does not confirm absence of activity on systems that are not monitored, in logs that are not ingested, or outside the retained time window. This daily intelligence package was not executed against a specific customer Microsoft Sentinel workspace, so no customer-specific finding is asserted.

Hunt Scope / What Was Reviewed

Available Microsoft Sentinel telemetry can be reviewed for the confirmed domain/IP, published hashes, malicious filenames, Terraform execution, DNS requests, firewall/proxy/VPC activity, provisioner-to-network correlation, and credential-discovery behavior where relevant telemetry is ingested.

KQL Hunting Content

Hunt 1 – First-Pass: Coder Exfiltration Domain

DeviceNetworkEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where RemoteUrl in~ ("coder-infra.com","www.coder-infra.com") or RemoteIP == "199.91.220.205"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated asc

Hunt 2 – Published Malicious Module Hashes

let CoderHashes = dynamic(["7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398", "a7f4fa5f7e33b2a6f6488cf28444584caa449144d246b083de919162f5514247", "414d01f6072fbf05bef513e277f4c2b504a413c8e2aa5bae133a5cbc0cda9dc1", "a64ce3038f2a501c9735abf6a1f9f04cbddbad53371cd68bec0f7510365c8ffa", "ebbe0d2ed8cfaf9e19edb38ce44d6b407f9771b5c0813a7add27c05f66e89596", "7ef6b8c3c976fb60b3fa22e9e294ba548d9b532e060c1323a0124a3a7a647f13"]);
union isfuzzy=true
(DeviceFileEvents | where TimeGenerated >= datetime(2026-08-31T07:35:00Z) | where SHA256 in~ (CoderHashes) | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, SourceTable="DeviceFileEvents"),
(DeviceProcessEvents | where TimeGenerated >= datetime(2026-08-31T07:35:00Z) | where SHA256 in~ (CoderHashes) | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, SourceTable="DeviceProcessEvents")
| sort by TimeGenerated asc

Hunt 3 – dlp.sh and dlp-docker.sh Artifacts

DeviceFileEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where FileName in~ ("dlp.sh","dlp-docker.sh")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 4 – Terraform External Telemetry Execution

DeviceProcessEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where ProcessCommandLine has_any ("data.external.telemetry","dlp-docker.sh","dlp.sh","coder-infra.com")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 5 – DNS Requests to Coder Lookalike Infrastructure

union isfuzzy=true
(DnsEvents | where TimeGenerated >= datetime(2026-08-31T07:35:00Z) | where Name in~ ("coder-infra.com","www.coder-infra.com") | project TimeGenerated, ClientIP, QueryName=Name, SourceTable="DnsEvents"),
(ASimDnsActivityLogs | where TimeGenerated >= datetime(2026-08-31T07:35:00Z) | where DnsQuery in~ ("coder-infra.com","www.coder-infra.com") | project TimeGenerated, ClientIP=SrcIpAddr, QueryName=DnsQuery, SourceTable="ASimDnsActivityLogs")
| sort by TimeGenerated asc

Hunt 6 – Network Security Logs for Exfiltration Infrastructure

CommonSecurityLog
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where DestinationIP == "199.91.220.205" or DestinationHostName in~ ("coder-infra.com","www.coder-infra.com") or tostring(column_ifexists("RequestURL","")) has "coder-infra.com"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, DestinationHostName, RequestURL=tostring(column_ifexists("RequestURL","")), DeviceAction, Message
| sort by TimeGenerated asc

Hunt 7 – Provisioner Process Followed by Exfiltration

let Exfil = DeviceNetworkEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where RemoteUrl in~ ("coder-infra.com","www.coder-infra.com") or RemoteIP == "199.91.220.205"
| project DeviceId, NetworkTime=TimeGenerated, RemoteIP, RemoteUrl, RemotePort;
DeviceProcessEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where FileName in~ ("terraform","terraform.exe","coder","coder.exe","coderd","coderd.exe","sh","bash")
| join kind=inner Exfil on DeviceId
| where NetworkTime between (TimeGenerated .. TimeGenerated + 10m)
| project TimeGenerated, NetworkTime, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| sort by NetworkTime asc

Hunt 8 – Credential Discovery From Coder or Terraform Context

DeviceProcessEvents
| where TimeGenerated >= datetime(2026-08-31T07:35:00Z)
| where FileName in~ ("sh","bash","python","python3","cat","grep","find","env","printenv")
| where ProcessCommandLine has_any (".ssh","AWS_ACCESS_KEY","AWS_SECRET","AZURE_","GOOGLE_","OIDC","token","history","terraform","coder")
| where InitiatingProcessFileName in~ ("terraform","terraform.exe","coder","coder.exe","coderd","coderd.exe","sh","bash") or InitiatingProcessCommandLine has_any ("coder","terraform")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Detection Notes

  • Highest signal: coder-infra.com, 199.91.220.205, vendor-published hashes, dlp-docker.sh, and data.external.telemetry.
  • The incident window is critical for scoping exposure.
  • Malicious modules may remain cached after the delivery window.
  • DNS, proxy, firewall, and VPC flow telemetry may show exfiltration even without endpoint telemetry.
  • DeviceProcessEvents and DeviceFileEvents require endpoint coverage on Coder provisioners/workspaces.
  • No traffic to the confirmed domain does not conclusively prove a deployment was unaffected.

Leave a comment