Back Cybersecuritynews

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access and Steal Secrets

Cybersecuritynews •Tushar Subhra Dutta • March 30, 2026

A financially motivated cybercrime group has been quietly compromising cloud environments since late 2025, and its activities are now drawing serious concern across the security community. The group, known as TeamPCP, operates a self-propagating worm called CanisterWorm that hunts for poorly secured Docker APIs, Kubernetes clusters, Redis servers, and systems vulnerable to the React2Shell flaw. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CanisterWorm Malware Targets Cloud Environments to Steal Secrets TeamPCP, a financially motivated cybercrime group, is exploiting poorly secured cloud environments with a self-propagating malware called CanisterWorm. This malware targets exposed Docker APIs, Kubernetes clusters, and Redis servers, leveraging known vulnerabilities such as React2Shell to gain unauthorized access. The campaign has been active since late 2025 but escalated significantly over the past weekend, raising alarms within the cybersecurity community. Victims are at risk of credential theft and extortion. The scope of the impact is broad, affecting numerous organizations with insecure cloud configurations. Security experts are urging immediate action to secure these systems. Current status indicates ongoing exploitation and heightened alert among cybersecurity professionals. 2 sources 67

Extracted Entities

CanisterWorm Malware Attacking Docker/K8s/Redis to Gain Access and Steal Secrets

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (2)

Tools (1)