‘CanisterWorm’ Springs Wiper Attack Targeting Iran

2026-03-25T19:23:32Z5033e4c0806f190d03b110d21cd42722c5150436c388244f58d4f4f466b31984
AI assistantsAisuruCanisterWormDDoSDortI2PIoTIranJackSkidKimwolfMFA-bypassMicrosoft Patch TuesdayMossadScattered Lapsus ShinyHuntersStarkillerStrykerbotnetdata-wipeextortioninsider-threatphishingphishing-as-a-servicevulnerabilitieswiperzero-day

What happened

Multiple high-impact threats and ecosystem shifts reported: a financially motivated group unleashed “CanisterWorm,” a worm that propagates via poorly secured cloud services and wipes systems configured for Iran (time zone/Farsi); an Iran-linked hacktivist actor claims a wiper attack against medical device vendor Stryker; law enforcement disrupted four massive IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that infected millions of devices and powered record DDoS campaigns; the Kimwolf botnet and its operator (“Dort”) continue to be active and have disrupted the I2P anonymity network; a new “S

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
krebs_on_security
Record identifier
5033e4c0806f190d03b110d21cd42722c5150436c388244f58d4f4f466b31984
Enrichment time
2026-03-25T19:23:32Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.