logo

CanisterWorm Gets Destructive as TeamPCP Deploys Iran-Focused Kubernetes Wiper

ID: c7e7a7ad-abde-5950-8275-4a7273386dd8

STIX ID: report--c7e7a7ad-abde-5950-8275-4a7273386dd8

Feed Name: cybersecurityNews.com

Threat Score
90/100

Date Published: 2026-03-24

Date Updated: 2026-04-21

Author: Tushar Subhra Dutta

...
...

**TeamPCP has deployed a destructive Kubernetes-aware wiper (‘kamikaze’) that checks for Iranian system locale/timezone and either completely wipes affected hosts or deploys a backdoor on non-Iranian systems; it can brick entire clusters via a DaemonSet that mounts the host root and also includes variants that self-spread via SSH and exposed Docker APIs, while using rotating Cloudflare tunnel domains and ICP canister C2 infrastructure.**

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.