Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Canister Worm’ Springs Wiper Attack Targeting Iran

Summary: A financially motivated cybercrime group called TeamPCP deployed a self-propagating worm over the weekend that wipes data on infected systems set to Iran's time zone or Farsi as the default language, and destroys every node in a Kubernetes cluster if the victim has one. The group, which Flare says compromised servers that were 61% Azure and 36% AWS, used infrastructure from its March 19 supply chain attack on Aqua Security's Trivy scanner to push the payload, and Wiz reports it also compromised the GitHub Action for Checkmarx's KICS scanner between 12:58 and 16:50 UTC on March 23.

What you should know: TeamPCP's edge is not novel exploits but industrialized automation of known misconfigurations and recycled tooling, and Aikido researcher Charlie Eriksen says there is no reliable way to tell whether the wiper actually destroyed data - while the group sits on a credential stash it has only sampled publicly.

Read the original at Krebs on Security ↗

Topics
Cloud Security
Related