Kamikaze
Kamikaze is a destructive wiper malware attributed in the reporting to TeamPCP. It appears as an Iran-targeted destructive payload used alongside broader TeamPCP supply-chain and worm activity, including the Trivy compromise, the CanisterWorm campaign, and malicious Python package incidents. The malware is described as activating when systems are geolocated in Iran or configured for the Iranian timezone; when those conditions are met, credential-stealing behavior is suppressed and the Kamikaze wiper is launched instead. On Kubernetes environments in Iran, Kamikaze deploys as or via a container named "kamikaze" and uses privileged DaemonSet-style propagation to reach every node, including reports that it wipes nodes and force-reboots them. On non-Kubernetes Iranian hosts, the destructive behavior is reported as filesystem wiping, including use of "rm -rf / --no-preserve-root." Outside Iran, related TeamPCP malware instead delivered persistence or backdoor functionality such as host-provisioner-std or the CanisterWorm backdoor rather than the wiper. Reporting also states that the same .WAV-based concealment technique used in other TeamPCP malware was previously used to hide payloads associated with Kamikaze distributed via CanisterWorm and exposed Docker instances. High-confidence indicators and behaviors mentioned in the content include the container name "kamikaze," Iran/IP or timezone-based activation logic, DaemonSet deployment across Kubernetes clusters, and destructive wiping of filesystems and cluster nodes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For systems with Iranian IP geolocation, a destructive kamikaze payload was delivered that wiped filesystems; all other systems received a persistent host-provisioner-std backdoor.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Discovery
3 techniques
Discovery
When the updated worm infects machines, it checks if the machine is in the Iranian timezone or is configured for use in that country.
Lateral Movement
2 techniques
Lateral Movement
Impact
5 techniques
Impact
For non-Kubernetes Iranian hosts, the attackers utilized the destructive command rm -rf / --no-preserve-root to erase data.
On Iranian systems it deployed a host-provisioner-iran DaemonSet, mounted the host root filesystem, and ran a container named kamikaze that deleted the host filesystem and force-rebooted the node.
Iranian nodes get wiped and force-rebooted via a container named 'kamikaze.'
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A destructive payload delivered selectively to systems geolocated to Iranian IP space, intended to wipe filesystems.
A wiper malware previously distributed via CanisterWorm and exposed Docker instances, noted here for using the same .WAV payload concealment technique.
A destructive wiper payload triggered by CanisterWorm on systems identified as being in Iran. It wipes Kubernetes clusters by deploying a DaemonSet to every node, or runs 'rm -rf / --no-preserve-root' on non-Kubernetes systems.
Destructive Kubernetes wiper payload used to erase Iranian Kubernetes clusters; related destructive activity on non-Kubernetes Iranian hosts used 'rm -rf / --no-preserve-root'.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.