A sophisticated new cyber threat dubbed the CanisterWorm wiper attack targeting Iran has emerged, marking a dangerous shift for a cybercrime group previously known for financial extortion. The campaign specifically identifies and destroys data on systems utilizing Iranian time zones or those with Farsi set as the default language, leveraging a self-propagating worm to infiltrate poorly secured cloud services.
The operation is the perform of TeamPCP, a relatively new threat actor that has evolved from siphoning credentials to deploying destructive payloads. While the group originally focused on data theft and extortion via Telegram, this latest variant introduces a geopolitically targeted wiper designed to cripple infrastructure within Iran. The attack is particularly potent against Kubernetes clusters, where it can systematically wipe every node, including the control plane.
Security researchers have noted that TeamPCP does not rely on novel exploits but instead “industrializes” existing vulnerabilities and misconfigurations. By automating well-known attack techniques, the group has created a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating ecosystem, predominantly targeting major cloud providers.
The Mechanics of the ‘Kamikaze’ Wiper
The wiper component of the worm employs a strict identification process to ensure it only destroys data on targeted Iranian systems. Once a host is infected, the malware checks the system’s timezone and locale settings. If these match Iranian parameters, the payload triggers a destructive sequence based on the environment.
On Kubernetes-native systems, the worm deploys privileged DaemonSets across every node in the cluster. This allows the attackers to maintain control and execute a wiper payload via a container specifically named “kamikaze,” which force-reboots and wipes the nodes. For Iranian hosts not running Kubernetes, the malware executes a blunt rm -rf / --no-preserve-root command to erase the local machine’s file system.
Interestingly, the worm treats non-Iranian nodes differently. Rather than destroying them, it installs the CanisterWorm backdoor as a systemd service, ensuring the group maintains persistent access to the rest of the network. To hide its presence, the malware disguises its persistence mechanisms as PostgreSQL tooling, using names such as pglog, pg_state, and internal-monitor.
Blockchain-Based Command and Control
The infrastructure behind this campaign is why researchers have named it “CanisterWorm.” TeamPCP orchestrates its operations using an Internet Computer Protocol (ICP) canister—a blockchain-based “smart contract” that combines code and data. Because ICP canisters are distributed and tamperproof, they are highly resistant to traditional takedown attempts. they remain online as long as the operators pay the required virtual currency fees.
The specific ICP canister identified in the campaign is tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io. This C2 (command and control) infrastructure has been used to drop payloads into the /tmp/pglog path. To deliver these payloads, the group has been observed rotating multiple Cloudflare tunnel domains to avoid detection.
The worm’s ability to spread is further enhanced by network-based lateral movement. It parses authentication logs to find stolen SSH keys and exploits exposed Docker APIs on port 2375 across local subnets, allowing it to hop from one compromised cloud instance to another with minimal resistance.
A Massive Supply Chain Compromise
The wiper attack is only one facet of TeamPCP’s broader strategy. Between late February and March 2026, the group conducted a calculated sequence of supply chain attacks against widely trusted open-source security tools. According to Unit 42, the group compromised the vulnerability scanners Trivy (from Aqua Security) and KICS (from Checkmarx), as well as the AI gateway LiteLLM and the official Python SDK of Telnyx.
These attacks involved injecting malicious infostealer payloads directly into GitHub Actions and Python Package Index (PyPI) registries. Once executed during routine automated workflows, the malware silently extracted sensitive data, including cloud access tokens, Kubernetes secrets, and SSH keys. The scale of this breach is staggering: sources cited by Unit 42 suggest that attackers may have exfiltrated over 300 GB of data and secrets from 500,000 infected machines .
Specifically, on March 19, 2026, TeamPCP executed a supply chain attack against Trivy, injecting credential-stealing malware into official releases on GitHub actions . Later, on March 23, 2026, the group pushed similar malware to the KICS vulnerability scanner, with the GitHub Action being compromised between 12:58 and 16:50 UTC that day.
Targeting the Cloud Control Plane
TeamPCP’s strategy differs from traditional malware in that it ignores conclude-user devices in favor of cloud infrastructure. The group weaponizes exposed control planes to gain a foothold in corporate environments. This approach has proven highly effective; a profile published by the security firm Flare indicated that Azure (61%) and AWS (36%) accounted for 97% of the group’s compromised servers.
By targeting the “plumbing” of the cloud—such as Redis servers and exposed Docker APIs—TeamPCP can move laterally through a victim’s network to siphon credentials and extort the company. This “cloud-native” approach allows them to scale their attacks rapidly, using the victim’s own infrastructure to propagate the worm.
The group has as well displayed a streak of erratic behavior, often referred to by researchers as “Chaotic Evil.” While deploying destructive wipers and stealing corporate secrets, the group has used its infrastructure to spam GitHub accounts with junk messages and, at times, redirected visitors of its malicious canisters to a “Rick Roll” YouTube video.
Summary of TeamPCP Attack Vectors
| Target Component | Attack Method | Primary Goal |
|---|---|---|
| Kubernetes Clusters | Privileged DaemonSets (“kamikaze”) | Data wiping / Cluster destruction |
| GitHub Actions | Supply chain injection (Trivy, KICS) | Credential and token theft |
| Cloud Infrastructure | Exposed Docker APIs (Port 2375) | Lateral movement / Propagation |
| Iranian Systems | Timezone/Locale detection | Geopolitically targeted wiper attack |
As of April 2026, security firms continue to monitor the remnants of the CanisterWorm infrastructure. While the wiper payload was only active for a short period over a single weekend in March, the volume of stolen credentials suggests that TeamPCP possesses a vast stash of access tokens that could be used for future campaigns.
Organizations are urged to audit their GitHub Actions workflows, secure exposed Docker APIs, and ensure that Kubernetes control planes are not accessible to unauthorized entities. Further updates on the attribution and mitigation of TeamPCP’s activities are expected as security firms continue to analyze the exfiltrated data from the 500,000 impacted machines.
Do you have information on the impact of the CanisterWorm campaign or tips on securing cloud-native environments? Share your thoughts in the comments below.
Worth a look