Back Cybersecuritynews

CanisterWorm Gets Destructive as TeamPCP Deploys Iran

Cybersecuritynews •Tushar Subhra Dutta • March 24, 2026

A threat actor known as TeamPCP has taken a sharp turn toward destruction with a new payload that goes far beyond credential theft or backdoor installation. The group, tracked as a cloud-native attacker since late 2025, has deployed a Kubernetes wiper that specifically targets systems configured for Iran — a geopolitical targeting tactic that marks […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TeamPCP's CanisterWorm Targets Iranian Systems with Destructive Kubernetes Wiper TeamPCP has launched a new cyber campaign deploying a destructive payload that targets Kubernetes clusters configured for Iran. This wiper malware, part of the ongoing CanisterWorm campaign, uses the same command-and-control infrastructure as previous attacks, specifically the ICP canister (tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io). When the malware detects an Iranian configuration, it deploys a DaemonSet named 'host-provisioner-iran' that wipes the host's filesystem and forces a reboot. For non-Iranian targets, it installs a backdoor instead. The attack is notable for its geopolitical targeting, marking a shift from credential theft to outright destruction. The malware also affects non-Kubernetes systems by attempting to delete user files. This campaign is an evolution of TeamPCP's tactics, indicating a growing threat to cloud-native environments. Current assessments highlight the urgency of addressing this threat due to its destructive capabilities. 4 sources 78

Extracted Entities

CanisterWorm Gets Destructive as TeamPCP Deploys Iran

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)