‘CanisterWorm’ Springs Wiper Attack Targeting Iran. But why?

A financially motivated cybercrime group named TeamPCP is running a self-propagating worm (leveraging exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability) that spreads through cloud environments, steals credentials, extorts victims via Telegram, and deploys a wiper targeting systems using Iran's time zone or Farsi settings; the report notes active destructive behavior and raises questions about the group's motivations and possible geopolitical implications.