CP
cyberpings
Malware & RansomwareHIGH

CanisterWorm - New Wiper Attack Targets Iran's Cloud Services

KoKrebs on Security·Reporting by BrianKrebs
📰 4 sources·Summary by CyberPings Editorial·AI-assisted·Reviewed by Rohit Rana
Updated:
🎯

Basically, a new computer worm is deleting data on systems in Iran.

Quick Summary

A new wiper attack called CanisterWorm is targeting Iranian systems through cloud services. TeamPCP, the group behind it, is exploiting vulnerabilities to wipe data. This poses serious risks for organizations in the region, highlighting the need for enhanced security measures.

What Happened

A financially motivated cybercrime group, known as TeamPCP, has launched a wiper attack targeting systems in Iran. This new worm, dubbed CanisterWorm, spreads through poorly secured cloud services and is designed to wipe data on systems that use Iran's time zone or have Farsi set as the default language. The attack began over the weekend, indicating a strategic move by the group to exploit ongoing tensions in the region.

The worm exploits vulnerabilities in cloud infrastructure, specifically targeting misconfigured Docker APIs, Kubernetes clusters, and Redis servers. TeamPCP has been active since December 2025, focusing on corporate cloud environments. Their approach relies on the automation of existing attack techniques, allowing them to compromise systems at scale.

Who's Being Targeted

The primary targets of CanisterWorm are organizations operating within Iran or those utilizing cloud services configured to match Iranian settings. This includes businesses that rely on Azure and AWS, which account for the majority of compromised servers. The group's choice of targets reflects a broader trend of cybercriminals leveraging geopolitical conflicts to further their financial motives.

Experts believe that the wiper attack could have devastating effects on the data integrity of affected organizations. If the worm successfully identifies a target in Iran, it can wipe data across entire Kubernetes clusters, posing a significant risk to businesses reliant on these technologies.

Signs of Infection

Organizations should be vigilant for unusual activity, particularly if they operate in cloud environments. Signs of infection may include unexpected data loss, unusual access patterns, or alerts from security tools regarding compromised cloud services. The worm's self-propagating nature means it can spread quickly, making early detection crucial.

In addition to the wiper component, TeamPCP has been known to steal sensitive data, including SSH keys and cloud credentials. This dual threat of data theft and destruction makes CanisterWorm particularly dangerous for organizations in the region.

How to Protect Yourself

To mitigate the risks posed by CanisterWorm, organizations should take immediate action to secure their cloud environments. This includes:

  • Reviewing cloud configurations: Ensure that all services are properly secured and that unnecessary access is restricted.
  • Implementing monitoring solutions: Use security tools that can detect anomalies in cloud activity and alert administrators to potential breaches.
  • Educating staff: Train employees on recognizing phishing attempts and securing credentials, as social engineering tactics may accompany such attacks.

As the cyber threat landscape continues to evolve, staying informed about emerging threats like CanisterWorm is essential for maintaining robust cybersecurity practices.

🔒 Pro insight: The automation and scale of TeamPCP's attacks signal a troubling trend in cloud security, necessitating immediate defensive measures from affected organizations.

Original article from

KoKrebs on Security· BrianKrebs
Read Full Article

Also covered by

BLBleepingComputer

TeamPCP deploys Iran-targeted wiper in Kubernetes attacks

Read Article
CYCyber Security News

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access and Steal Secrets

Read Article
ARArs Technica Security

Self-propagating malware poisons open source software and wipes Iran-based machines

Read Article

Share

Related Pings

HIGHMalware & Ransomware

Malware Newsletter Round 91 - Latest Threats and Insights

The latest malware newsletter reveals new threats like Infiniti Stealer and npm supply chain attacks. Developers and organizations must stay alert to evolving risks in cybersecurity.

Security Affairs·
HIGHMalware & Ransomware

Malicious Email Delivers CMD Malware - Privilege Escalation Alert

A malicious email has delivered a .cmd malware file that escalates privileges and bypasses antivirus systems. Users are at risk of significant system compromise. Awareness and immediate action are vital to mitigate this threat.

Security Affairs·
HIGHMalware & Ransomware

Axios NPM Package Compromised - Supply Chain Attack Exposed

A major supply chain attack compromised the Axios NPM package, affecting millions of users. Malicious versions deployed a RAT, posing serious security risks. Swift action was taken to remove the threats.

Trend Micro Research·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Chaos Malware - New Targeting of 64-bit Linux Servers

Chaos malware has evolved to target 64-bit Linux servers, expanding its attack surface. This shift raises alarms for organizations relying on these systems. Enhanced security measures are now crucial to protect against potential larger-scale attacks.

SC Media·
HIGHMalware & Ransomware

Phorpiex Botnet - Spreading Ransomware and Sextortion Tactics

The notorious Phorpiex botnet is back, spreading ransomware and sextortion schemes. Millions are at risk as it targets users globally. Stay alert and protect your devices from this evolving threat.

Cyber Security News·