CanisterWorm Wiper Attack Targets Iran: Inside TeamPCP’s Cloud‑Native Assault

An emerging financially motivated crime ring has unleashed a self‑propagating worm dubbed CanisterWorm that zeroes in on systems set to Iran’s time zone or default Farsi locale.

CanisterWorm wiper campaign hits Iran‑linked systems

The operation traces back to the relatively new group TeamPCP, which first surfaced in December 2025 by compromising cloud‑hosted Docker APIs, Kubernetes clusters, Redis instances and exploiting the React2Shell flaw. Their playbook relies on automation rather than novel exploits, turning exposed control planes into a sprawling criminal ecosystem. According to Flare, 61% of compromised servers run on Azure and 36% on AWS, figures rendered as ↓ 61% and ↓ 36% respectively. In March, the gang hijacked the Trivy vulnerability scanner’s GitHub Actions pipeline, inserting credential‑stealing code that siphoned SSH keys, cloud tokens and crypto wallets. The same infrastructure was repurposed over the weekend to deliver a payload that, when it detects an Iranian timezone or Farsi locale, erases data on every node of a vulnerable Kubernetes cluster or, failing that, wipes the local host.

“If it doesn’t find Iran, it simply wipes the machine,” said Charlie Eriksen of Aikido in a recent briefing.

The worm is delivered via an Internet Computer Protocol (ICP) canister – a blockchain‑based smart contract that resists takedown as long as the operators fund it with cryptocurrency. TeamPCP bragged on a Telegram channel about stealing “vast amounts of sensitive data” from a multinational pharma firm and flooding compromised GitHub accounts with junk messages to keep malicious packages visible in search results, a tactic highlighted by Reuters. Security analysts caution that the short‑lived burst may have been a stunt to attract attention, yet the underlying supply‑chain compromise of tools like Trivy and the KICS scanner underscores a growing trend of cloud‑native ransomware‑as‑a‑service targeting geopolitical hotspots.