CanisterWorm Targets Docker, Kubernetes, and Redis to Steal Secrets

TeamPCP is conducting a large-scale, financially motivated campaign that targets exposed cloud services (Docker APIs, Kubernetes, Redis) and developer tooling by deploying CanisterWorm, a worm that harvests SSH keys, cloud credentials, Kubernetes tokens and crypto wallets, enables persistent access for extortion via Telegram, and includes a locale/timezone-aware wiper for Iran-configured systems; attackers also trojanized Trivy releases via compromised CI/CD workflows and leverage ICP canisters and GitHub abuse to increase resilience and distribution.