Back Gbhackers

CanisterWorm Targets Docker, Kubernetes, and Redis to Steal Secrets

Gbhackers •Mayura Kathir • March 30, 2026

A financially motivated cybercrime group known as TeamPCP is actively exploiting poorly secured cloud environments using a self-propagating malware called “CanisterWorm.” The campaign targets exposed Docker APIs, Kubernetes clusters, Redis servers, and known vulnerabilities like React2Shell to gain unauthorized access, steal credentials, and extort victims. The activity escalated over the past weekend with a destructive […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CanisterWorm Malware Targets Cloud Environments to Steal Secrets TeamPCP, a financially motivated cybercrime group, is exploiting poorly secured cloud environments with a self-propagating malware called CanisterWorm. This malware targets exposed Docker APIs, Kubernetes clusters, and Redis servers, leveraging known vulnerabilities such as React2Shell to gain unauthorized access. The campaign has been active since late 2025 but escalated significantly over the past weekend, raising alarms within the cybersecurity community. Victims are at risk of credential theft and extortion. The scope of the impact is broad, affecting numerous organizations with insecure cloud configurations. Security experts are urging immediate action to secure these systems. Current status indicates ongoing exploitation and heightened alert among cybersecurity professionals. 2 sources 67

Extracted Entities

CanisterWorm Targets Docker, Kubernetes, and Redis to Steal Secrets

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)