Back Gbhackers

TeamPCP Unleashes Iran

Gbhackers •Mayura Kathir • March 24, 2026

CanisterWorm’s latest evolution turns TeamPCP’s cloud-native toolkit into a geopolitically tuned wiper, capable of bricking entire Kubernetes clusters when it lands on systems configured for Iran. The campaign reuses the same Internet Computer Protocol (ICP) canister C2 and backdoor infrastructure seen in the earlier Trivy and NPM CanisterWorm incidents. However, it now adds selective destruction […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TeamPCP's CanisterWorm Targets Iranian Systems with Destructive Kubernetes Wiper TeamPCP has launched a new cyber campaign deploying a destructive payload that targets Kubernetes clusters configured for Iran. This wiper malware, part of the ongoing CanisterWorm campaign, uses the same command-and-control infrastructure as previous attacks, specifically the ICP canister (tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io). When the malware detects an Iranian configuration, it deploys a DaemonSet named 'host-provisioner-iran' that wipes the host's filesystem and forces a reboot. For non-Iranian targets, it installs a backdoor instead. The attack is notable for its geopolitical targeting, marking a shift from credential theft to outright destruction. The malware also affects non-Kubernetes systems by attempting to delete user files. This campaign is an evolution of TeamPCP's tactics, indicating a growing threat to cloud-native environments. Current assessments highlight the urgency of addressing this threat due to its destructive capabilities. 4 sources 78

Extracted Entities

TeamPCP Unleashes Iran

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)