Coder's registry servers hijacked to spread malware

Coder, a platform used by developers to manage infrastructure-as-code, has confirmed that its registry infrastructure was compromised. The breach involved unauthorised registry servers added to its Cloudflare environment, which then delivered malicious Terraform modules to users.

What happened

Attackers gained access to Coder's Cloudflare infrastructure and deployed rogue registry servers. These servers distributed Terraform modules embedded with credential-stealing code. The malicious modules were designed to exfiltrate sensitive credentials from developers' environments, though the exact scope of affected users remains unclear. Coder has not disclosed how the initial breach occurred or whether any customer data was accessed beyond the distribution of the compromised modules.

The company detected the incident and removed the unauthorised servers, but details about the timeline—such as when the breach began or how long the malicious modules were active—have not been provided. There is no confirmation yet on whether the attackers targeted specific organisations or if the attack was opportunistic.

What we don't know yet

Sources do not specify the number of users or organisations impacted by the malicious modules. It is also unclear whether the credential-stealing code successfully exfiltrated any data before the rogue servers were taken down. Coder has not released technical indicators of compromise (IoCs) or guidance for users to verify if their environments were affected. The method used to compromise the Cloudflare infrastructure remains undisclosed, leaving questions about potential vulnerabilities in Coder's security practices.