Loading malware…
CanisterWorm is a self-propagating software supply-chain worm used by the financially motivated threat actor TeamPCP. Observed in March 2026, it initially spread through npm publishing tokens harvested during the Trivy compromise. It targets developer systems and CI/CD environments, stealing npm authentication tokens and using them to enumerate accessible packages, increment patch versions, and publish malicious updates. The campaign compromised more than 60 npm packages across multiple publisher scopes.
Compromised packages execute a malicious post-install script that deploys a Python-based backdoor on Linux systems. The backdoor establishes persistence through a systemd user service and periodically retrieves payload locations from an Internet Computer Protocol (ICP) canister, providing decentralized command-and-control infrastructure. CanisterWorm also harvests cloud credentials, access tokens, and API keys associated with AWS, Google Cloud, and Azure. Google identifies SANDCLOCK as a Python-based component of the malware publicly referred to as CanisterWorm.
Later associated payloads expanded propagation into Kubernetes environments and added container-escape, SSH, and Docker propagation capabilities. Some variants masquerade as legitimate system services or database utilities. Destructive payloads associated with the campaign have performed recursive file deletion, including geographically selective wiping of Iranian systems. The worm's principal infection vector is compromised software distributed through trusted package registries rather than direct social engineering.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A July FBI advisory (PDF) identified TeamPCP malware including CanisterWorm, SANDCLOCK, Mini Shai-Hulud and Miasma.
Google stated that SANDCLOCK is a component of what has publicly been referred to as CanisterWorm.
123 distinct techniques documented for this family, organized by ATT&CK tactic.
The token was a long-lived classic npm access token -- exactly the type that TeamPCP's CanisterWorm findNpmTokens() function harvests from CI/CD environments.
Each infected package acted as a new telemetry node, performing environment fingerprinting...
The encrypted payload was sent to a typosquatted domain (scan.aquasecurtiy[.]org)
as well as launch the self-replicating CanisterWorm across the JavaScript npm ecosystem
Databricks, the cloud data analytics platform, is investigating an alleged security compromise linked to the TeamPCP credential harvest.
Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
The worm operated autonomously, stealing npm authentication tokens from compromised environments, resolving which packages each token could publish, incrementing patch version numbers to trigger routine update workflows, and republishing poisoned copies while preserving original READMEs to avoid raising maintainer suspicion.
...spreading a data wiping worm known as “CanisterWorm” through vulnerable cloud instances with Farsi as their default language or clocks set to Iran’s time zone.
It started with Aqua Security’s Trivy scanner and propagated downstream to multiple packages and repositories in a ripple effect fueled by the malware’s worm-like behavior and by the automated inclusion of the malicious libraries in more builds.
[CanisterWorm](https://attack.mitre.org/software/S9042) has spread through an automated process that infects and publishes npm packages.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
Attackers target open-source packages and products, compromise supplier credentials or CI/CD systems, and push malicious package versions that are then installed by downstream users.
The targets weren’t end users. They were the tools developers trust every day inside their build pipelines.
Persistence: Achieving persistence through scheduled tasks/cron (systemd services) and deploying containers.
[CanisterWorm](https://attack.mitre.org/software/S9042) has registered itself as a systemd service for persistence on targeted Kubernetes nodes.(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting and immediate credential harvesting...
[CanisterWorm](https://attack.mitre.org/software/S9042) has used shell commands to enable and start the malicious systemd service for execution and persistence.(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) has used a Python script as a second-stage backdoor.(Citation: Aikido TeamPCP Trivy MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.(Citation: Aikido TeamPCP Trivy MAR 2026)
MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation
TeamPCP first gained notoriety in December 2025 in connection with the mass exploitation of the React2Shell vulnerability (CVE-2025-55182), a critical pre-authentication remote code execution flaw in React Server Components.
The artificial intelligence (AI) company said a GitHub Actions workflow it uses as part of its macOS app-signing process downloaded and executed Axios version 1.14.1.
This file runs automatically as a postinstall hook during npm install.
[CanisterWorm](https://attack.mitre.org/software/S9042) has used executed `systemctl --user daemon-reload` to reload systemd, then enables and starts the malicious service.(Citation: Aikido TeamPCP Trivy MAR 2026)
March 19 the malicious actor used the token to push changes which manipulated existing tags of previous releases, this would have caused anyone using these tags in their CI pipelines to download the compromised versions the next occasion the pipeline ran.
The script generates a Python .pth-based payload designed to execute when Python starts
[CanisterWorm](https://attack.mitre.org/software/S9042) can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)
deploying privileged DaemonSets to brick entire clusters
Concurrently, a worm variant designated CanisterWorm was observed using the ICP canister C2 infrastructure to propagate across Kubernetes environments.
[CanisterWorm](https://attack.mitre.org/software/S9042) has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
Persistence: Achieving persistence through scheduled tasks/cron (systemd services) and deploying containers.
[CanisterWorm](https://attack.mitre.org/software/S9042) has registered itself as a systemd service for persistence on targeted Kubernetes nodes.(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
...as well as by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.
deploy.js takes npm tokens, resolves usernames, enumerates all publishable packages, bumps patch versions, and publishes the payload across the entire scope.
The worm used an Internet Computer Protocol (ICP) canister as its command-and-control dead-drop — the first documented use of ICP for C&C, according to Aikido.
[CanisterWorm](https://attack.mitre.org/software/S9042) can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.(Citation: Aikido TeamPCP Trivy MAR 2026)
T1543.002 — Create or Modify System Process: Systemd Service (Persistence)
Distributed via malicious postinstall hooks in compromised npm packages, the worm installed a Python backdoor...
CanisterWorm abuses this standard feature to execute malicious code on the developer’s machine or CI/CD runner without any additional action required. The postinstall entry in compromised package.json files pointed to index.js.
These attacks also establish persistent backdoors for lateral movement across clusters... The attack uses WAV steganography to hide encrypted second-stage payloads within valid audio files, allowing the malware to bypass network filters while establishing persistence on Windows, Linux and macOS systems.
Persistence is established by means of a systemd user service, which is configured to automatically start the Python backdoor after a 5-second delay if it gets terminated for some reason by using the "Restart=always" directive.
The malicious script would also scan memory regions used by the GitHub Actions Runner.Worker process ... to find additional authentication secrets.
Version 3 enabled... harvesting SSH keys.
Persistence: Achieving persistence through scheduled tasks/cron (systemd services) and deploying containers.
[CanisterWorm](https://attack.mitre.org/software/S9042) has registered itself as a systemd service for persistence on targeted Kubernetes nodes.(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}
Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
...as well as by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.
[CanisterWorm](https://attack.mitre.org/software/S9042) can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.(Citation: Aikido TeamPCP Trivy MAR 2026)
T1543.002 — Create or Modify System Process: Systemd Service (Persistence)
Distributed via malicious postinstall hooks in compromised npm packages, the worm installed a Python backdoor...
CanisterWorm abuses this standard feature to execute malicious code on the developer’s machine or CI/CD runner without any additional action required. The postinstall entry in compromised package.json files pointed to index.js.
These attacks also establish persistent backdoors for lateral movement across clusters... The attack uses WAV steganography to hide encrypted second-stage payloads within valid audio files, allowing the malware to bypass network filters while establishing persistence on Windows, Linux and macOS systems.
Persistence is established by means of a systemd user service, which is configured to automatically start the Python backdoor after a 5-second delay if it gets terminated for some reason by using the "Restart=always" directive.
[CanisterWorm](https://attack.mitre.org/software/S9042) has checked if the current user is root. If it is, [CanisterWorm](https://attack.mitre.org/software/S9042) will wipe the system using `rm –rf / --no-preserve-root`. If it is not, [CanisterWorm](https://attack.mitre.org/software/S9042) will try passwordless sudo and will run the same command.(Citation: Aikido CanisterWorm MAR 2026)
Privilege Escalation: Exploiting privileged Kubernetes workloads and escaping to the host.
MITRE ATT&CK Mapping Technique ID Implementation Obfuscated Files / Information T1027 AES-256-GCM encrypted payload constants; JS obfuscation; scramble()
v3.3 WAV steganography: payloads hidden in audio files (bg_kube.wav, bg_prop.wav)
[CanisterWorm](https://attack.mitre.org/software/S9042) has used embedded second stage Base64-encoded payloads.(Citation: Aikido TeamPCP Trivy MAR 2026)
the malware exfiltrated stolen data to the vendor-themed typosquat domain checkmarx[.]zone .
[CanisterWorm](https://attack.mitre.org/software/S9042) has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.(Citation: Aikido TeamPCP Trivy MAR 2026)
the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}
A kill-switch is embedded in the payload: if the returned URL contains youtube.com, execution is skipped, allowing the attacker to keep infected systems dormant and avoid detection.
[CanisterWorm](https://attack.mitre.org/software/S9042) has deleted itself after execution.(Citation: Aikido CanisterWorm MAR 2026)
Attackers used compromised tokens and GitHub credentials to replace CI scripts, trigger publishing workflows, create public repositories, and publish malicious updates through automated systems.
designed to harvest sensitive information, including cloud access tokens, credentials, API keys, and other authentication material associated with services such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.
[CanisterWorm](https://attack.mitre.org/software/S9042) has decoded a long Base64 string to obtain a Python script for its second-stage payload.(Citation: Aikido TeamPCP Trivy MAR 2026)
Beyond stealing credentials and achieving persistence, the threat actors also masqueraded their activity as legitimate services like systemd and disguised the threat as a PostgreSQL utility called pgmon.
[CanisterWorm](https://attack.mitre.org/software/S9042) can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.(Citation: Aikido CanisterWorm MAR 2026)
The Python backdoor slept 5 minutes (sandbox evasion)
A kill-switch is embedded in the payload: if the returned URL contains youtube.com , execution is skipped, allowing the attacker to keep infected systems dormant and avoid detection.
[CanisterWorm](https://attack.mitre.org/software/S9042) has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.(Citation: Aikido TeamPCP Trivy MAR 2026)
March 19 the malicious actor used the token to push changes which manipulated existing tags of previous releases, this would have caused anyone using these tags in their CI pipelines to download the compromised versions the next occasion the pipeline ran.
The script generates a Python .pth-based payload designed to execute when Python starts
The malicious script would also scan memory regions used by the GitHub Actions Runner.Worker process ... to find additional authentication secrets.
Version 3 enabled... harvesting SSH keys.
The token was a long-lived classic npm access token -- exactly the type that TeamPCP's CanisterWorm findNpmTokens() function harvests from CI/CD environments.
They also compromised the trivy-action and setup-trivy GitHub Actions, embedding credential-harvesting payloads that read CI/CD environment variables and runner process memory via /proc/<pid>/mem.
Version 3 enabled the scanning of exposed Docker APIs, port 2375 and the local subnet. It also enabled harvesting SSH keys.
[CanisterWorm](https://attack.mitre.org/software/S9042) has gathered cloud access tokens.(Citation: FBI TeamPCP JUL 2026)
Additionally, it attempts to steal browser extension data associated with MetaMask and Phantom...
It also swept 50+ filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, and cryptocurrency wallets.
S1ngularity started by "pulling a token from the repository" and Shai-Hulud variants exploited long-lived credentials found in compromised repositories.
It checks three places: .npmrc configuration files (in the home directory, current directory, and /etc/npmrc), environment variables matching patterns like NPM_TOKEN and NPM_TOKENS, and the live npm configuration via npm config get.
[CanisterWorm](https://attack.mitre.org/software/S9042) has gathered SSH private keys from the .ssh file.(Citation: Aikido CanisterWorm MAR 2026)
SANDCLOCK: a credential stealing tool used by TeamPCP that extracts AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data.
the malware silently extracts highly sensitive data, such as: Cloud access tokens SSH keys Kubernetes secrets... Alert Name... Kubernetes secret value extraction activity.
malicious code was automatically executed when the infected package was fetched and run to harvest credentials, tokens, API keys, and other secrets.
[CanisterWorm](https://attack.mitre.org/software/S9042) has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.(Citation: FBI TeamPCP JUL 2026)
The malicious script would also scan memory regions used by the GitHub Actions Runner.Worker process ... to find additional authentication secrets.
Version 3 enabled... harvesting SSH keys.
malicious code was automatically executed when the infected package was fetched and run to harvest credentials, tokens, API keys, and other secrets.
[CanisterWorm](https://attack.mitre.org/software/S9042) has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.(Citation: Aikido CanisterWorm MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) has scanned the local /24 subnet for new targets.(Citation: Aikido CanisterWorm MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) has parsed the /var/log/auth.log and /var/log/secure files for usernames.(Citation: Aikido CanisterWorm MAR 2026)
v3 Pure SSH/Docker worm (scans local /24 for ports 22, 2375)
Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting...
[CanisterWorm](https://attack.mitre.org/software/S9042) has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.(Citation: Aikido TeamPCP Trivy MAR 2026)
For each token, it calls the npm /-/whoami endpoint to get the associated username
[CanisterWorm](https://attack.mitre.org/software/S9042) has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)
The Python backdoor slept 5 minutes (sandbox evasion)
A kill-switch is embedded in the payload: if the returned URL contains youtube.com , execution is skipped, allowing the attacker to keep infected systems dormant and avoid detection.
[CanisterWorm](https://attack.mitre.org/software/S9042) has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.(Citation: Aikido TeamPCP Trivy MAR 2026)
Authenticate via /-/whoami, enumerate publishable packages via maintainer search
This secondary payload performs environment fingerprinting to identify Kubernetes clusters...
[CanisterWorm](https://attack.mitre.org/software/S9042) has performed environment fingerprinting to identify Kubernetes clusters.(Citation: Palo Alto TeamPCP MAR 2026) [CanisterWorm](https://attack.mitre.org/software/S9042) has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.(Citation: Aikido CanisterWorm MAR 2026)
Payload checks timezone and locale to identify Iranian systems ... It checks the system timezone and locale. If the machine is configured for Iran (Asia/Tehran, Iran, or fa_IR), the payload takes a very different path.
[CanisterWorm](https://attack.mitre.org/software/S9042) has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)
// Title: TeamPCP Network Artifacts // Description: AWS and Kube API interaction from a single python process indicative of the enumeration and lateral movement observed by TeamPCP // MITRE ATT&CK TTP ID: T1021.007
Lateral Movement: Deploying containers and using remote services (container hopping).
v3 Pure SSH/Docker worm (scans local /24 for ports 22, 2375)
// Title: TeamPCP Network Artifacts // Description: AWS and Kube API interaction from a single python process indicative of the enumeration and lateral movement observed by TeamPCP // MITRE ATT&CK TTP ID: T1021.007
MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation
The worm operated autonomously, stealing npm authentication tokens from compromised environments, resolving which packages each token could publish, incrementing patch version numbers to trigger routine update workflows, and republishing poisoned copies while preserving original READMEs to avoid raising maintainer suspicion.
TeamPCP deployed a worm-driven campaign that leveraged exposed Docker APIs, Kubernetes clusters, Ray dashboards, and Redis servers in conjunction with React2Shell exploitation.
[CanisterWorm](https://attack.mitre.org/software/S9042) has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
These attacks also establish persistent backdoors for lateral movement across clusters.
Each infected package acted as a new telemetry node... attempting to exfiltrate data from local .env files and AWS/Azure configuration directories... The script functioned as a comprehensive secret-sweeper where it harvested: SSH keys Cloud credentials ... Kubernetes configuration files ... environment variables containing LLM API keys.
// Title: TeamPCP File Creation Artifacts // Description: Identifies file artifacts related to the TeamPCP enumeration, persistence and exfiltration activity // MITRE ATT&CK TTP ID: T1074
It also swept 50+ filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, and cryptocurrency wallets.
extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets
If the primary C2 server failed, the payload used the backup domain tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io .
One of the most striking aspects of the campaign was its extensive use of legitimate platforms for C2 and exfiltration. Rather than relying exclusively on traditional malware infrastructure, the attackers used GitHub repositories as dead-drop locations for stolen data.
The backdoor polls this endpoint every approximately 50 minutes using a spoofed browser User-Agent string.
Command and Control: Establishing C2 via proxies (FRPS, GOST, P2P relays), application layer protocols, and encrypted channels (Sliver C2 framework).
For command-and-control, TeamPCP employed Internet Computer Protocol (ICP) blockchain canisters—decentralized, immutable smart contracts hosted on the ICP network.
Technique ID Context Web Service T1102 ICP canister dead-drop C2
[CanisterWorm](https://attack.mitre.org/software/S9042) can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)
[CanisterWorm](https://attack.mitre.org/software/S9042) has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes.(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026) [CanisterWorm](https://attack.mitre.org/software/S9042) has also downloaded kubectl to compromised environments if it was not already installed.(Citation: Aikido CanisterWorm MAR 2026)
Harvested data was encrypted with AES-256-CBC... with the session key wrapped by a hardcoded RSA-4096 public key... A later iteration embedded malware payloads inside WAV audio files using Base64 encoding within the file...
CanisterWorm uses a decentralized Internet Computer Protocol (ICP) canister for C2, providing a tamper-proof dead-drop for payload delivery that is resistant to typical worm takedown operations.
the Python backdoor slept 5 minutes ... then polled the ICP canister ... for a URL pointing to the current payload.
Command and Control: Establishing C2 via proxies (FRPS, GOST, P2P relays), application layer protocols, and encrypted channels (Sliver C2 framework).
The worm automated token-to-compromise: given one stolen npm token, it enumerated all publishable packages, bumped versions, and published across the entire scope in under 60 seconds.
After a 5-minute sleep, it polls an ICP canister... every ~50 minutes. The canister returns a URL pointing to the next-stage payload.
It encrypted the results and exfiltrated them to an attacker-controlled domain impersonating Checkmarx infrastructure... It encrypted the results and exfiltrated them to the same audit.checkmarx[.]cx domain used in the KICS attack.
Once encrypted on the host, the data is then sent to models.litellm[.]cloud using the header X-Filename: tpcp.tar.gz.
Primary channel was HTTPS POST to scan.aquasecurtiy[.]org ... Fallback: if INPUT_GITHUB_PAT was available, the malware created a public tpcp-docs repository on the victim’s GitHub account and uploaded the encrypted bundle as a release asset.
MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567.002 GitHub repo commits; GitHub Actions artifacts; P2P Session network
[CanisterWorm](https://attack.mitre.org/software/S9042) has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)
Harvested data was encrypted using AES-256-CBC with RSA-4096 hybrid encryption ... Only the attacker’s private key can decrypt.
find /mnt/host -maxdepth 1 -not -name 'mnt' -exec rm -rf {} + || true chroot /mnt/host reboot -f
deploying privileged DaemonSets to brick entire clusters
[CanisterWorm](https://attack.mitre.org/software/S9042) has forced the target system to reboot after file deletion.(Citation: Aikido CanisterWorm MAR 2026)
The original TeamPCP campaign report documented a conditional wiper... attempted to destroy data, wiping Kubernetes clusters node by node, or the local machine if no cluster was found.
Researchers have additionally observed activity involving CanisterWorm, malware that targeted Kubernetes environments and reportedly deployed destructive functionality against selected Iranian targets.
TeamPCP then attempted to move laterally through victim networks, siphoning authentication credentials and extorting victims over Telegram.
102 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
126 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.