Executive SummaryRisk level: Critical
What happened

The CanisterWorm wiper, attributed to TeamPCP, targeted Iran's cloud infrastructure via a supply-chain compromise of the Trivy scanner (malicious code injected through GitHub Actions on March 19, 2026); the payload checks for Iranian locale and wipes Kubernetes clusters or local systems after exfiltrating data.

Who is affected

Organizations with Iranian-locale systems and misconfigured cloud infrastructure (Docker APIs, Kubernetes, Redis).

Why it matters

A destructive wiper delivered via a trusted supply chain can cause irreversible data loss across entire clusters.

Immediate recommended actions

  • Verify Trivy integrity/provenance and pin trusted releases.
  • Lock down exposed Docker APIs, Kubernetes, and Redis with auth.
  • Monitor Kubernetes audit logs for unauthorized deployments.
  • Maintain offline, immutable backups isolated from the cluster.
How to read this report. Items are labelled by confidence: Confirmed stated as fact in the source, Reported described by the source, Potential analyst inference, and Requires Validation to be confirmed in your environment. Where the source lacks detail this is stated as “Not specified in the source material”.

Key Technical Findings

Vulnerability / Campaign Type

Destructive wiper (CanisterWorm) delivered via software-supply-chain compromise.

Affected Systems

Iranian-locale systems; misconfigured Docker APIs, Kubernetes clusters, Redis servers.

Initial Access Vector

Supply-chain compromise of Trivy via malicious GitHub Actions injection.

Execution Method

Wiper payload deployed and executed (T1203).

Persistence

Use of misconfigured cloud services for ongoing access.

Privilege Escalation

Exploiting privileged containers/services.

Defense Evasion

Obfuscation techniques.

Credential Access

Harvesting credentials from compromised environments.

Lateral Movement

Spreading via compromised credentials across nodes.

Data Exfiltration

C2 over web protocols (T1071.001); data exfiltrated before wiping.

Impact Level

Critical – cluster-wide data destruction.

Technical Background

CanisterWorm reached targets through a supply-chain compromise of the Trivy vulnerability scanner, with malicious code injected via GitHub Actions into legitimate releases. The payload then exploited exposed cloud services (unauthenticated Docker APIs, insecure Kubernetes, Redis) and a referenced React2Shell flaw to execute (T1203).

Its wiper logic checks for Iranian locale: if a Kubernetes cluster is found it triggers a cascading wipe across nodes, otherwise it destroys the local machine – after exfiltrating data over web protocols (T1071.001). Defenses center on supply-chain integrity, cloud-service hardening, Kubernetes audit monitoring, and isolated immutable backups.

Attack Chain Analysis

  1. Initial Access

    ActivityCompromise Trivy supply chain via GitHub Actions.

    EvidenceTampered Trivy releases.

    TelemetryCI/CD logs, software provenance.

    Detection opportunityVerify release integrity/signatures.

  2. Execution

    ActivityDeploy wiper via exposed cloud services (T1203).

    EvidenceUnauthorized container/cluster activity.

    TelemetryKubernetes audit, cloud logs.

    Detection opportunityAlert on unauthorized deployments.

  3. Credential Access

    ActivityHarvest credentials from the environment.

    EvidenceAccess to secrets/config.

    TelemetryCloud audit, EDR.

    Detection opportunityDetect secret access anomalies.

  4. Exfiltration

    ActivityExfiltrate data before wiping (T1071.001).

    EvidenceOutbound transfers to C2.

    TelemetryProxy/firewall.

    Detection opportunityFlag egress to rare hosts.

  5. Impact

    ActivityWipe clusters or local systems.

    EvidenceMass deletion/destruction.

    TelemetryCloud/EDR logs.

    Detection opportunityAlert on mass-delete operations.

Deep Technical Behavior Analysis

The defining behaviors are trusted-supply-chain delivery, locale-gated targeting, and cluster-wide destruction. Because the wiper rides a trusted tool and abuses cloud misconfigurations, supply-chain integrity verification, cloud hardening, Kubernetes audit monitoring, and isolated immutable backups are the decisive controls.

Specific C2 indicators and payload hashes are not specified in the source material and require validation.

Indicators of Compromise

No indicators of compromise were provided in the source material.

Indicators of Behavior

Behavioral indicators to hunt for even when atomic IoCs are limited (Potential — validate against your baseline).

Behavioral Indicator Description Data Source Confidence
Web shell-like activity New/modified server-side scripts in writable web paths; anomalous POSTs. Web access/error logs, FIM Potential
Abnormal 403/404/500 patterns Enumeration or exploitation attempts against endpoints. Web server logs, WAF Potential
Beaconing to rare destinations Periodic outbound connections to newly-seen domains/IPs or direct-IP C2. Proxy, firewall, DNS logs Potential
Unusual DNS queries High-entropy or rare domains; possible tunneling. DNS resolver logs Potential
Authentication anomalies Spraying/stuffing, impossible travel, or MFA fatigue patterns. IdP/VPN logs, Azure AD/Okta sign-ins Potential
Suspicious IAM/OAuth changes New API keys, OAuth apps, service principals, or role grants. CloudTrail, Azure AD audit, GCP audit Potential

Detection Engineering Guidance

Defensive detection logic (Potential — tune to your environment). No exploit code is included; logic is for hunting and alerting only.

T1071.001 — Application Layer Protocol: Web Protocols
  • ObjectiveDetect C2 over web protocols
  • Suspicious patternBeaconing to rare destinations
  • Data sourceProxy, firewall, DNS
  • False positivesAdmin tooling/automation; baseline before alerting.
  • ResponseTriage host, validate scope, preserve evidence, contain if confirmed.
pseudo: periodic outbound (low jitter) to newly-seen domain/IP
  with small uniform payloads => alert(level=medium)
Platform Log Source What to Look For Priority
Endpoint EDR / Defender telemetry Process tree, persistence, tamper attempts High
Web Web server access logs Anomalous POSTs, new endpoints, web-shell-like requests High
Web Web server error logs Repeated 403/404/500 bursts on single endpoints Medium
Cloud CloudTrail / Azure AD / GCP audit IAM/OAuth changes, key creation, role grants, sign-ins High
Identity IdP / VPN logs Impossible travel, spraying, MFA fatigue High
Network DNS resolver logs Rare/high-entropy domains, tunneling Medium
Network Proxy / firewall logs Beaconing, direct-IP C2, exfil volume High

MITRE ATT&CK Mapping

Tactic Technique ID Technique Name Relevance Detection Opportunity Confidence
C2 T1071.001 Application Layer Protocol: Web Protocols Utilizing HTTP/HTTPS for command and control communications. Monitor for unusual outbound connections to known C2 IPs. Reported
Execution T1203 Exploitation for Client Execution Exploiting software vulnerabilities to execute malicious code. Log application crashes and analyze stack traces for anomalies. Reported

Incident Response Guidance

  • Validate exposure and confirm whether the issue applies to your environment.
  • Preserve evidence (memory, disk, relevant logs) before remediation.
  • Isolate affected hosts/accounts if compromise is suspected.
  • Collect volatile data and review the log sources listed above.
  • Hunt for the indicators of behavior and any related atomic indicators.
  • Rotate potentially exposed credentials, keys, and session tokens.
  • Remove persistence (tasks, services, keys, web shells, cron, OAuth grants).
  • Patch affected systems; reimage where integrity cannot be assured.
  • Run post-remediation validation and a BAS/security-validation retest.

Remediation and Hardening

  • Patch affected systems and reduce internet-exposed services.
  • Enforce MFA and least-privilege for privileged and remote access.
  • Improve endpoint telemetry (Sysmon/EDR) and PowerShell logging.
  • Restrict script execution and constrain LOLBins where feasible.
  • Monitor persistence locations and disable unnecessary services.
  • Segment critical assets and review privileged accounts.
  • Rotate secrets and remove credentials from configuration files.
  • Tune SIEM/EDR detections, then validate controls after changes.

Business Risk

  • Service disruption: degraded or unavailable systems during compromise or recovery.
  • Data exposure: risk to sensitive, regulated, or customer data depending on scope.
  • Regulatory exposure: potential breach-notification and compliance obligations.
  • Financial impact: incident response, downtime, and potential extortion costs.
  • Brand and trust impact: reputational damage with customers and partners.
  • Identity blast radius: compromised accounts can expand access across cloud and SaaS.

Executive Takeaway

What leadership needs to know: A destructive wiper delivered via a trusted supply chain can cause irreversible data loss across entire clusters. Current assessed risk: Critical.

Prioritise: patching/exposure reduction, identity hardening (MFA, least privilege), and detection coverage for the techniques above.

Validate after remediation: re-test controls with breach & attack simulation to confirm the relevant techniques are now prevented or detected.

Validating Your Defenses with Valitrix

The Valitrix Breach and Attack Simulation (BAS) platform provides organizations with the capability to continuously validate their security controls against real-world adversary techniques, including those utilized in the CanisterWorm attack. By leveraging Valitrix’s automated simulations, security teams can safely emulate specific tactics from the MITRE ATT&CK framework associated with this threat actor. This approach allows teams to assess their detection capabilities and response readiness in real-time without risking production environments.

The platform enables organizations to identify gaps in defenses by simulating attacks on their cloud infrastructure. Through these simulations, security teams gain valuable insights into how effectively their controls are positioned against advanced threats like CanisterWorm, ensuring they can adapt their strategies proactively to mitigate risks effectively.

Key Takeaways

  • The CanisterWorm wiper attack targets Iranian cloud infrastructure using advanced techniques.
  • TeamPCP relies on exploiting misconfigured cloud services and vulnerabilities for execution.
  • Kubernetes cluster security is critical in preventing widespread data loss during attacks.
  • Continuous validation of security controls with Valitrix aids in strengthening defenses against evolving threats.

Frequently Asked Questions

What is the main objective of the CanisterWorm wiper attack?

The primary objective is to disrupt Iranian systems by wiping critical data from compromised cloud infrastructures.