5 Critical Facts About the CanisterWorm Wiper Attack on Iran

In a startling escalation of cyber conflict, a financially motivated cybercrime group has launched a wiper campaign specifically targeting Iranian infrastructure. Known as CanisterWorm, this self-propagating malware exploits cloud misconfigurations to spread, then wipes data on systems set to Iran's time zone or Farsi language. The attacks, first observed in March 2025, come from the relatively new group TeamPCP, which previously orchestrated a major supply chain attack on the Trivy vulnerability scanner. This article breaks down five essential details about the CanisterWorm operation and its implications for cloud security.

1. The Emergence of TeamPCP

TeamPCP materialized in late 2025 as a financially motivated data theft and extortion group. However, their actions have taken a sharp geopolitical turn. According to security firm Flare, the group does not rely on novel exploits but rather industrializes known vulnerabilities and misconfigurations into a cloud-native exploitation platform. Their primary targets are corporate cloud environments, with an overwhelming focus on Microsoft Azure (61%) and Amazon Web Services (36%). The CanisterWorm campaign is their most notable effort to date, demonstrating their ability to pivot from extortion to destructive wiper attacks. This shift indicates that TeamPCP may be willing to act as a cyber mercenary for state interests, or it could reflect a personal vendetta. Either way, their rapid evolution from a common cybercrime gang to a geopolitical threat actor is alarming.

2. How CanisterWorm Spreads Through Cloud Misconfigurations

CanisterWorm spreads by targeting exposed cloud infrastructure components. The worm specifically attacks exposed Docker APIs, Kubernetes clusters, Redis servers, and machines vulnerable to the React2Shell vulnerability. Once inside, it moves laterally through the victim network, stealing authentication credentials and often extorting victims over Telegram. The group's strength lies in automation: they scan the internet for misconfigured control planes and infect them at scale. This approach requires no sophisticated malware—just persistence and a deep understanding of cloud defaults. Security researcher Charlie Eriksen from Aikido notes that TeamPCP's infrastructure is built for maximum reach, allowing them to compromise thousands of systems quickly. Any organization running unsecured cloud services—especially those with open Kubernetes dashboards or unauthenticated Docker daemons—is at risk.

3. The Wiper Payload Specifically Targets Iran

Over the weekend of March 22–23, 2025, TeamPCP deployed a new payload within CanisterWorm that executes a wiper attack. The malware checks the victim's system time zone and locale. If they match Iran's time zone (UTC+3:30) or have Farsi set as the default language, the wiper activates. When triggered, the malware destroys data on all nodes in any accessible Kubernetes cluster. If no cluster is available, it wipes the local machine entirely. This targeted payload suggests that TeamPCP intended to disrupt Iranian operations specifically. The attack was not financially motivated in the traditional sense—instead, it was purely destructive. Researchers at Aikido dubbed the campaign CanisterWorm due to the group's use of blockchain-based canisters for command and control, but the wiper component itself is a custom tool designed for a single purpose: to erase data belonging to Iranian users or systems.

4. The Trivy Supply Chain Attack

Prior to the wiper campaign, TeamPCP executed a sophisticated supply chain attack on Trivy, a popular open-source vulnerability scanner from Aqua Security. On March 19, 2025, the group compromised official GitHub Actions releases of Trivy and injected credential-stealing malware. The malicious versions were published to official repositories before Aqua Security removed them. During the brief window of compromise, the malware stole SSH keys, cloud credentials, Kubernetes tokens, and cryptocurrency wallets from users who downloaded the affected releases. Security firm Wiz noted that the attackers used the same technical infrastructure for this attack and the later wiper campaign. This connection reveals that TeamPCP is not a one-off threat but an organized group capable of multi-vector operations. The supply chain attack demonstrates their ability to target widely used tools, amplifying their reach and impact.

5. The Role of Internet Computer Protocol (ICP) Canisters

The name CanisterWorm comes from TeamPCP's reliance on Internet Computer Protocol (ICP) canisters—a tamperproof, blockchain-based system of smart contracts. These canisters act as a decentralized command-and-control infrastructure, making it difficult for authorities to take down the operation. The ICP canisters store the latest payloads and instructions for infected machines, allowing TeamPCP to update their malware dynamically. This approach also provides resilience: even if one canister is disabled, others remain active. Security researcher Assaf Morag from Flare emphasizes that the group's innovation is not in code but in operational architecture. By leveraging blockchain technology, TeamPCP ensures that their infrastructure is decentralized and highly available. This represents a new evolution in cybercrime, where groups borrow from legitimate blockchain projects to build robust, resilient attack platforms. Understanding this infrastructure is key to defending against future CanisterWorm variants.

The CanisterWorm wiper attack on Iran marks a dangerous convergence of financially motivated cybercrime and geopolitical destruction. While TeamPCP initially focused on extortion, their pivot to targeted wiper attacks suggests a growing willingness to engage in state-level disruptions. Organizations worldwide—especially those with cloud exposure—must harden their environments against self-propagating worms that exploit basic misconfigurations. The use of ICP canisters adds a layer of complexity to takedowns, meaning proactive security is more critical than ever. As TeamPCP continues to evolve, staying informed about their tactics is the first line of defense.