--- title: ‘CanisterWorm’ Springs Wiper Attack Targeting Iran –... description: A cybercrime group called TeamPCP has deployed a wiper worm dubbed CanisterWorm that targets cloud infrastructure and destroys data on systems configured with... canonical: https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ‘CanisterWorm’ Springs Wiper Attack Targeting Iran – Krebs on Security | daily.dev og:description: A cybercrime group called TeamPCP has deployed a wiper worm dubbed CanisterWorm that targets cloud infrastructure and destroys data on systems configured with... og:url: https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa og:image: https://api.daily.dev/og/posts/Z63HufrFA.png og:image:alt: ‘CanisterWorm’ Springs Wiper Attack Targeting Iran – Krebs on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ‘CanisterWorm’ Springs Wiper Attack Targeting Iran – Krebs on Security **[Krebs on Security](https://daily.dev/sources/krebsonsecurity)** · 5 min read · 0 upvotes · 0 comments ## Summary A cybercrime group called TeamPCP has deployed a wiper worm dubbed CanisterWorm that targets cloud infrastructure and destroys data on systems configured with Iran's timezone or Farsi locale. The group previously compromised Aqua Security's Trivy vulnerability scanner via a GitHub Actions supply chain attack, stealing SSH keys, cloud credentials, Kubernetes tokens, and crypto wallets. TeamPCP uses Internet Computer Protocol (ICP) blockchain canisters to orchestrate attacks, making their infrastructure resistant to takedown. The wiper, if it detects an Iranian environment with Kubernetes access, destroys data across all cluster nodes. Security researchers note the group is financially motivated but appears to be using the Iran-targeting angle partly for notoriety, and experts warn that GitHub's malware problem is growing as supply chain attacks increase in frequency. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Self-propagating malware poisons open source software and wipes Iran-based machines](https://daily.dev/posts/self-propagating-malware-poisons-open-source-software-and-wipes-iran-based-machines-7pp4muj7u) · Ars Technica · 0 upvotes · 0 comments - [Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure](https://daily.dev/posts/weaponizing-the-protectors-teampcp-s-multi-stage-supply-chain-attack-on-security-infrastructure-fxtlie1qu) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#kubernetes](https://daily.dev/tags/kubernetes), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"‘CanisterWorm’ Springs Wiper Attack Targeting Iran – Krebs on Security","url":"https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa"},"datePublished":"2026-03-23T15:47:49.518Z","dateModified":"2026-03-23T15:48:16.381Z","description":"A cybercrime group called TeamPCP has deployed a wiper worm dubbed CanisterWorm that targets cloud infrastructure and destroys data on systems configured with...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16ce7a11a09cf7497187c22830463311?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/16ce7a11a09cf7497187c22830463311?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Krebs on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Krebs on Security","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/deb3e417ddef4d0e8cc4d704becf6004","url":"https://daily.dev/sources/krebsonsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/canisterworm-springs-wiper-attack-targeting-iran-krebs-on-security-z63hufrfa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,kubernetes,malware","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Krebs on Security","item":"https://daily.dev/sources/krebsonsecurity"},{"@type":"ListItem","position":3,"name":"‘CanisterWorm’ Springs Wiper Attack Targeting Iran – Krebs on Security"}]} ```