‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-04-03T13:23:29Z•648e8503670e6d503c0bee9e14fb2db9e3118272eee852b3ba6255155bd30d23
AI assistantsAisuruCanisterWormDDoSI2PIoT botnetIran-linkedIran-targetingJackSkidKimwolfMFA-bypassMicrosoft Patch TuesdayMossadScattered Lapsus ShinyHuntersStarkillerStrykerbotnet-takedowncloud compromisedata-wipeextortioninsider-threatphishing-as-a-servicevulnerabilitieswiperzero-day
What happened
KrebsOnSecurity roundup (Feb–Mar 2026) covering multiple high-impact threats: a financially motivated group deployed ‘CanisterWorm’, a worming wiper that spreads via poorly secured cloud services and targets systems using Iran time zone or Farsi locale; an Iran-linked hacktivist wiper claimed against medical device firm Stryker; and continued disruption from massive IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) responsible for widespread DDoS and abuse of anonymity networks (I2P). Also highlighted: a stealthy phishing-as-a-service called ‘Starkiller’ that proxies real login pages and relays/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 648e8503670e6d503c0bee9e14fb2db9e3118272eee852b3ba6255155bd30d23
- Enrichment time
- 2026-04-03T13:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.