Skip to content

‘CanisterWorm’ Springs Wiper Attack Targeting Iran

Chimera readability score 0.5504 out of 100, reading level.

A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language.
Experts say the wiper campaign against Iran materialized this past weekend and came from a relatively new cybercrime group known as TeamPCP. In December 2025, the group began compromising corporate cloud environments using a self-propagating worm that went after exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability. TeamPCP then attempted to move laterally through victim networks, siphoning authentication credentials and extorting victims over Telegram.
In a profile of TeamPCP published in January, the security firm Flare said the group weaponizes exposed control planes rather than exploiting endpoints, predominantly targeting cloud infrastructure over end-user devices, with Azure (61%) and AWS (36%) accounting for 97% of compromised servers.
“TeamPCP’s strength does not come from novel exploits or original malware, but from the large-scale automation and integration of well-known attack techniques,” Flare’s Assaf Morag wrote. “The group industrializes existing vulnerabilities, misconfigurations, and recycled tooling into a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating criminal ecosystem.”
On March 19, TeamPCP executed a supply chain attack against the vulnerability scanner Trivy from Aqua Security, injecting credential-stealing malware into official releases on GitHub actions. Aqua Security said it has since removed the harmful files, but the security firm Wiz notes the attackers were able to publish malicious versions that snarfed SSH keys, cloud credentials, Kubernetes tokens and cryptocurrency wallets from users.
Over the weekend, the same technical infrastructure TeamPCP used in the Trivy attack was leveraged to deploy a new malicious payload which executes a wiper attack if the user’s timezone and locale are determined to correspond to Iran, said Charlie Eriksen, a security researcher at Aikido. In a blog post published on Sunday, Eriksen said if the wiper component detects that the victim is in Iran and has access to a Kubernetes cluster, it will destroy data on every node in that cluster.
“If it doesn’t it will just wipe the local machine,” Eriksen told KrebsOnSecurity.
Aikido refers to TeamPCP’s infrastructure as “CanisterWorm” because the group orchestrates their campaigns using an Internet Computer Protocol (ICP) canister — a system of tamperproof, blockchain-based “smart contracts” that combine both code and data. ICP canisters can serve Web content directly to visitors, and their distributed architecture makes them resistant to takedown attempts. These canisters will remain reachable so long as their operators continue to pay virtual currency fees to keep them online.
Eriksen said the people behind TeamPCP are bragging about their exploits in a group on Telegram and claim to have used the worm to steal vast amounts of sensitive data from major companies, including a large multinational pharmaceutical firm.
“When they compromised Aqua a second time, they took a lot of GitHub accounts and started spamming these with junk messages,” Eriksen said. “It was almost like they were just showing off how much access they had. Clearly, they have an entire stash of these credentials, and what we’ve seen so far is probably a small sample of what they have.”
Security experts say the spammed GitHub messages could be a way for TeamPCP to ensure that any code packages tainted with their malware will remain prominent in GitHub searches. In a newsletter published today titled GitHub is Starting to Have a Real Malware Problem, Risky Business reporter Catalin Cimpanu writes that attackers often are seen pushing meaningless commits to their repos or using online services that sell GitHub stars and “likes” to keep malicious packages at the top of the GitHub search page.
This weekend’s outbreak is the second major supply chain attack involving Trivy in as many months. At the end of February, Trivy was hit as part of an automated threat called HackerBot-Claw, which mass exploited misconfigured workflows in GitHub Actions to steal authentication tokens.
Eriksen said it appears TeamPCP used access gained in the first attack on Aqua Security to perpetrate this weekend’s mischief. But he said there is no reliable way to tell whether TeamPCP’s wiper actually succeeded in trashing any data from victim systems, and that the malicious payload was only active for a short time over the weekend.
“They’ve been taking [the malicious code] up and down, rapidly changing it adding new features,” Eriksen said, noting that when the malicious canister wasn’t serving up malware downloads it was pointing visitors to a Rick Roll video on YouTube.
“It’s a little all over the place, and there’s a chance this whole Iran thing is just their way of getting attention,” Eriksen said. “I feel like these people are really playing this Chaotic Evil role here.”
Cimpanu observed that supply chain attacks have increased in frequency of late as threat actors begin to grasp just how efficient they can be, and his post documents an alarming number of these incidents since 2024.
“While security firms appear to be doing a good job spotting this, we’re also gonna need GitHub’s security team to step up,” Cimpanu wrote. “Unfortunately, on a platform designed to copy (fork) a project and create new versions of it (clones), spotting malicious additions to clones of legitimate repos might be quite the engineering problem to fix.”
Update, 2:40 p.m. ET: Wiz is reporting that TeamPCP also pushed credential stealing malware to the KICS vulnerability scanner from Checkmarx, and that the scanner’s GitHub Action was compromised between 12:58 and 16:50 UTC today (March 23rd).
Interestingly, after the huge demonstrations a couple months ago, Iran shut down most of the Internet. Sorta kills the effect on Iranians of this attack.
The world would be a more stable place if the orange mental one hadn’t been coaxed into a Middle East war by Israel.
“I’m the President of Peace and will start no new wars”. Then jumping back to 2011 he outed the facts about himself: “The President will start a war with Iran to cover his crimes and because he’s a terrible negotiator … “.
One of these days, one of these days ….
I’m the President of Peace
I will start no new wars
And If you don’t believe me
I’ll have ICE deport you to Zanzibar
“chaotic evil” is a perfect description. my heart goes out to this person, whoever they are. u r da real revolutionary

Facts Only

Actor: TeamPCP
Action: Supply chain attack, wiper attack
Victim: Trivy (Aqua Security), Iran (potential)
Targeted Systems: Corporate cloud environments, Docker APIs, Kubernetes clusters, Redis servers, React2Shell vulnerability
Location: Global
Timeframe: December 2025 - Present

Executive Summary

A financially motivated cybercrime group, known as TeamPCP, is believed to be behind a supply chain attack on Trivy, a vulnerability scanner from Aqua Security. This attack involved injecting credential-stealing malware into official releases on GitHub actions. In response, the group has deployed a new malicious payload that executes a wiper attack if the user's timezone and locale correspond to Iran. If detected, this wiper component can destroy data on every node in an infected Kubernetes cluster. The incident highlights the increasing frequency of supply chain attacks and the challenges posed by the resilient infrastructure used by cybercriminals.

Full Take

In analyzing this article, several patterns from the A.R.C. Codex emerge. TeamPCP is engaging in emotional exploitation and distortion, using their actions to provoke fear and panic about potential data losses. The group is also employing bad faith tactics by spamming GitHub with junk messages, likely to ensure that any code packages tainted with their malware remain prominent in searches. Furthermore, there are patterns of evasion and authority games, as TeamPCP continues to change and update their malicious payloads, making it difficult to fully understand their intentions or the extent of their activities.
When examining the root cause of this narrative, it becomes clear that the paradigm driving this incident is the ongoing pursuit of financial gain by cybercriminals, coupled with a willingness to use sophisticated tactics and resilient infrastructure to achieve their goals. The implications of this incident are significant for human agency and dignity, as it highlights the vulnerability of critical infrastructure to attack and the potential for widespread data loss.
Finally, when considering bridge questions, it is worth asking: What measures can be taken to better secure corporate cloud environments against such attacks? How can the resilience of cybercriminal infrastructure be effectively countered? And, what role should government agencies and private companies play in addressing these challenges?

Sentinel — Human

Confidence

This analysis suggests that the article is likely written by a human, but there are some indicators of potential AI involvement, such as the political commentary at the end of the article. However, without additional context or data, it is difficult to definitively determine the authorship.

Signals Detected
low severity: Sentence length variance is somewhat uniform but not excessively so, suggesting potential human authorship
medium severity: The article presents a coherent narrative without an overwhelming emphasis on balance or detachment, which could be consistent with human authorship
low severity: While the article discusses several incidents related to TeamPCP, there is no evidence of a specific template or talking points being repeated across sources, indicating potential human authorship
medium severity: The political commentary at the end of the article seems unrelated to the main content and could be interpreted as an attempt to create a sensationalist or emotionally charged conclusion, but it is not clear whether this was done for dramatic effect or to mislead readers
Human Indicators
The political commentary at the end of the article seems unrelated to the main content and could be interpreted as an attempt to create a sensationalist or emotionally charged conclusion, which is not typical of synthetic content.