‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-03-26T13:23:31Z•76f8214c8a8b90ce5caaaf517ce00fbdb42d79b24b5b1f2dfe54dc2e38f3ab21
AI assistantsAisuruCanisterWormDDoSI2P disruptionIoT botnetIran-linked actorsIran-targetingJackSkidKimwolfMFA bypassMicrosoft Patch TuesdayMossadScattered Lapsus ShinyHuntersStarkillerStrykerbotmaster Dortcloud compromisedata extortionextortion/swattinginsider-riskphishing-as-a-servicevulnerability managementwiperworm
What happened
Collection of KrebsOnSecurity reports highlighting a surge in destructive and disruptive cyber activity: a new "CanisterWorm" wiper/ worm targeting systems using Iran time zone or Farsi and spreading via poorly secured cloud services; an alleged Iran-linked wiper attack against medtech firm Stryker; large-scale IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) responsible for record DDoS attacks and recent law-enforcement takedowns; Kimwolf’s ongoing disruption of the I2P anonymity network and coverage of the botmaster known as “Dort”; a stealthy phishing-as-a-service called “Starkiller” that (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 76f8214c8a8b90ce5caaaf517ce00fbdb42d79b24b5b1f2dfe54dc2e38f3ab21
- Enrichment time
- 2026-03-26T13:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.