‘CanisterWorm’ Springs Wiper Attack Targeting Iran

2026-03-24T07:23:30Z0255559072f16dac19511d4dfc0c4b98dcab9b0bbaa237b5872184c3833de005
AI assistantsAisuruDDoSI2P disruptionIoT botnetIranJackSkidKimwolfMFA bypassMicrosoft Patch TuesdayMossadStarkillerStrykerbotmaster (Dort)cloud compromiseextortioninsider-threatphishing-as-a-servicewiperwormzero-day

What happened

Multiple high-impact cyber incidents and trends reported: a financially motivated group (dubbed “CanisterWorm”) is deploying a worm that spreads via poorly secured cloud services and wipes systems configured for Iran time zone or Farsi; Iran-linked actors claim a destructive wiper attack against medtech firm Stryker. Law enforcement in the U.S., Canada and Germany disrupted four massive IoT botnets (Aisuru, Kimwolf, JackSkid and Mossad) that had compromised millions of devices and were powering record DDoS campaigns; Kimwolf remains active and has been used to disrupt the I2P anonymity network

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
krebs_on_security
Record identifier
0255559072f16dac19511d4dfc0c4b98dcab9b0bbaa237b5872184c3833de005
Enrichment time
2026-03-24T07:23:30Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.