‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-03-27T01:23:28Z•837c3aa794947f8ccca56dfe0adb3cec8b0a81136a7c820df0b88f39a0eace50
AI assistantsAisuruCanisterWormDDoSI2PIoTIran-backed actorsJackSkidKimwolfMFA bypassMicrosoftMossadPatch TuesdayScattered Lapsus (SLSH)StarkillerStrykerautonomous agentsbotnetcloud compromisedoomsday/swapping/swatting tacticsextortionphishingphishing-as-a-servicewiperzero-day
What happened
KrebsOnSecurity reporting (Mar 2026) highlights multiple active, high-impact threats: a financially motivated group deploying a worm called “CanisterWorm” that spreads via poorly secured cloud services and wipes systems configured for Iran time zone or Farsi; Iran-linked hacktivists claiming a wiper attack against medical device vendor Stryker; and continued large-scale IoT botnet activity (Kimwolf, Aisuru, JackSkid, Mossad) responsible for record DDoS attacks—some disrupted by US, Canadian and German authorities. Coverage also details Kimwolf’s disruption of the I2P anonymity network and doxx
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 837c3aa794947f8ccca56dfe0adb3cec8b0a81136a7c820df0b88f39a0eace50
- Enrichment time
- 2026-03-27T01:23:28Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.