TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Krebs on Security

‘CanisterWorm’ Springs Wiper Attack Targeting Iran

BrianKrebs · 2026-03-23 · Read original ↗

ATT&CK techniques detected

13 predictions
T1195.001Compromise Software Dependencies and Development Tools
99%
"’ t serving up malware downloads it was pointing visitors to a rick roll video on youtube. “ it ’ s a little all over the place, and there ’ s a chance this whole iran thing is just their way of getting attention, ” eriksen said. “ i feel like these people are really playing this…"
T1195.001Compromise Software Dependencies and Development Tools
98%
"business reporter catalin cimpanu writes that attackers often are seen pushing meaningless commits to their repos or using online services that sell github stars and “ likes ” to keep malicious packages at the top of the github search page. this weekend ’ s outbreak is the second…"
T1195.001Compromise Software Dependencies and Development Tools
94%
"to visitors, and their distributed architecture makes them resistant to takedown attempts. these canisters will remain reachable so long as their operators continue to pay virtual currency fees to keep them online. eriksen said the people behind teampcp are bragging about their e…"
T1485Data Destruction
89%
"and cryptocurrency wallets from users. over the weekend, the same technical infrastructure teampcp used in the trivy attack was leveraged to deploy a new malicious payload which executes a wiper attack if the user ’ s timezone and locale are determined to correspond to iran, said…"
T1195.001Compromise Software Dependencies and Development Tools
76%
"vulnerability scanner from checkmarx, and that the scanner ’ s github action was compromised between 12 : 58 and 16 : 50 utc today ( march 23rd )."
T1485Data Destruction
66%
"‘ canisterworm ’ springs wiper attack targeting iran a financially motivated data theft and extortion group is attempting to inject itself into the iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use iran ’ s …"
T1195.002Compromise Software Supply Chain
62%
"business reporter catalin cimpanu writes that attackers often are seen pushing meaningless commits to their repos or using online services that sell github stars and “ likes ” to keep malicious packages at the top of the github search page. this weekend ’ s outbreak is the second…"
T1195.002Compromise Software Supply Chain
60%
"vulnerability scanner from checkmarx, and that the scanner ’ s github action was compromised between 12 : 58 and 16 : 50 utc today ( march 23rd )."
T1195.001Compromise Software Dependencies and Development Tools
53%
", the security firm flare said the group weaponizes exposed control planes rather than exploiting endpoints, predominantly targeting cloud infrastructure over end - user devices, with azure ( 61 % ) and aws ( 36 % ) accounting for 97 % of compromised servers. “ teampcp ’ s streng…"
T1195Supply Chain Compromise
45%
"vulnerability scanner from checkmarx, and that the scanner ’ s github action was compromised between 12 : 58 and 16 : 50 utc today ( march 23rd )."
T1610Deploy Container
44%
"and cryptocurrency wallets from users. over the weekend, the same technical infrastructure teampcp used in the trivy attack was leveraged to deploy a new malicious payload which executes a wiper attack if the user ’ s timezone and locale are determined to correspond to iran, said…"
T1610Deploy Container
34%
", the security firm flare said the group weaponizes exposed control planes rather than exploiting endpoints, predominantly targeting cloud infrastructure over end - user devices, with azure ( 61 % ) and aws ( 36 % ) accounting for 97 % of compromised servers. “ teampcp ’ s streng…"
T1195.002Compromise Software Supply Chain
31%
"’ t serving up malware downloads it was pointing visitors to a rick roll video on youtube. “ it ’ s a little all over the place, and there ’ s a chance this whole iran thing is just their way of getting attention, ” eriksen said. “ i feel like these people are really playing this…"

Summary

A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran's time zone or have Farsi set as the default language.