Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 1 actor

Kamikaze

Kamikaze is a destructive wiper malware attributed in the reporting to TeamPCP. It appears as an Iran-targeted destructive payload used alongside broader TeamPCP supply-chain and worm activity, including the Trivy compromise, the CanisterWorm campaign, and malicious Python package incidents. The malware is described as activating when systems are geolocated in Iran or configured for the Iranian timezone; when those conditions are met, credential-stealing behavior is suppressed and the Kamikaze wiper is launched instead. On Kubernetes environments in Iran, Kamikaze deploys as or via a container named "kamikaze" and uses privileged DaemonSet-style propagation to reach every node, including reports that it wipes nodes and force-reboots them. On non-Kubernetes Iranian hosts, the destructive behavior is reported as filesystem wiping, including use of "rm -rf / --no-preserve-root." Outside Iran, related TeamPCP malware instead delivered persistence or backdoor functionality such as host-provisioner-std or the CanisterWorm backdoor rather than the wiper. Reporting also states that the same .WAV-based concealment technique used in other TeamPCP malware was previously used to hide payloads associated with Kamikaze distributed via CanisterWorm and exposed Docker instances. High-confidence indicators and behaviors mentioned in the content include the container name "kamikaze," Iran/IP or timezone-based activation logic, DaemonSet deployment across Kubernetes clusters, and destructive wiping of filesystems and cluster nodes.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamPCP

For systems with Iranian IP geolocation, a destructive kamikaze payload was delivered that wiped filesystems; all other systems received a persistent host-provisioner-std backdoor.

via cloud security alliancelabs.cloudsecurityalliance.org
MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique
T1610Deploy ContainerEvidence3

On Kubernetes: deploys privileged DaemonSets across every node, including control plane... Iranian nodes get wiped and force-rebooted via a container named 'kamikaze.'

Persistence

2 techniques
T1098.004SSH Authorized KeysEvidence1

...as well as by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.

T1543Create or Modify System ProcessEvidence1

On non-Iranian Kubernetes targets, it deployed host-provisioner-std, mounted / from the host, and installed persistent backdoor logic instead.

Privilege Escalation

2 techniques
T1098.004SSH Authorized KeysEvidence1

...as well as by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.

T1543Create or Modify System ProcessEvidence1

On non-Iranian Kubernetes targets, it deployed host-provisioner-std, mounted / from the host, and installed persistent backdoor logic instead.

Stealth

2 techniques
T1027.003SteganographyEvidence1

Our analysis reveals a three-stage runtime attack chain on Linux/macOS consisting of delivery via audio steganography, in-memory execution of a data harvester, and encrypted exfiltration.

T1497.001System ChecksEvidence1

When the updated worm infects machines, it checks if the machine is in the Iranian timezone or is configured for use in that country.

Discovery

3 techniques
T1497.001System ChecksEvidence1

When the updated worm infects machines, it checks if the machine is in the Iranian timezone or is configured for use in that country.

T1613Container and Resource DiscoveryEvidence3

Their growing sophistication is best exemplified by the emergence of a new wiper malware that spreads through CanisterWorm, as well as by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.

T1614System Location DiscoveryEvidence1

If it detects a Kubernetes network... located in Iran, specifically Asia/Tehran timezone...

Lateral Movement

2 techniques
T1210Exploitation of Remote ServicesEvidence1

Their growing sophistication is best exemplified... by exploiting SSH via stolen keys and exposed Docker APIs on port 2375 across the local subnet.

T1570Lateral Tool TransferEvidence1

The shell script uses the same ICP canister linked to CanisterWorm... Non-Iranian nodes get the CanisterWorm backdoor installed as a systemd service.

Impact

5 techniques
T1485Data DestructionEvidence4

For non-Kubernetes Iranian hosts, the attackers utilized the destructive command rm -rf / --no-preserve-root to erase data.

T1486Data Encrypted for ImpactEvidence1

On Iranian systems it deployed a host-provisioner-iran DaemonSet, mounted the host root filesystem, and ran a container named kamikaze that deleted the host filesystem and force-rebooted the node.

T1529System Shutdown/RebootEvidence1

Iranian nodes get wiped and force-rebooted via a container named 'kamikaze.'

T1561Disk WipeEvidence1

On Iranian systems it deployed a host-provisioner-iran DaemonSet, mounted the host root filesystem, and ran a container named kamikaze that deleted the host filesystem and force-rebooted the node.

T1561.001Disk Content WipeEvidence1

On Iranian systems it deployed a host-provisioner-iran DaemonSet, mounted the host root filesystem, and ran a container named kamikaze that deleted the host filesystem and force-rebooted the node.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app1 month ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.