CanisterWorm Gets Destructive as TeamPCP Deploys Iran-Focused Kubernetes Wiper
ID: c7e7a7ad-abde-5950-8275-4a7273386dd8
STIX ID: report--c7e7a7ad-abde-5950-8275-4a7273386dd8
Feed Name: cybersecurityNews.com
Threat Score
**TeamPCP has deployed a destructive Kubernetes-aware wiper (‘kamikaze’) that checks for Iranian system locale/timezone and either completely wipes affected hosts or deploys a backdoor on non-Iranian systems; it can brick entire clusters via a DaemonSet that mounts the host root and also includes variants that self-spread via SSH and exposed Docker APIs, while using rotating Cloudflare tunnel domains and ICP canister C2 infrastructure.**
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
