‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-04-04T19:23:26Z•89668022be5245be486f2899127c99daeb87cf4cc953fa9b42d0fc0aacfd7f5b
AisuruCanisterWormDDoSFarsiI2PIoTIranIran-backed actorsJackSkidKimwolfMFA bypassMossadStarkillerStrykeranonymity network disruptionbotnetcloud misconfigurationcredential theftdata wipeextortionlaw enforcementphishing-as-a-servicetakedownwiperworm
What happened
A collection of KrebsOnSecurity reports covering multiple active high-impact threats and developments: 'CanisterWorm', a worming wiper campaign targeting systems configured for Iran/Farsi and spreading via poorly secured cloud services; large-scale IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) responsible for record DDoS attacks and recently disrupted by international law enforcement; claimed Iran-linked wiper against medical-device maker Stryker; stealthy phishing-as-a-service ('Starkiller') that proxies real login pages and captures MFA; ongoing disruption of the I2P anonymity network by K
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 89668022be5245be486f2899127c99daeb87cf4cc953fa9b42d0fc0aacfd7f5b
- Enrichment time
- 2026-04-04T19:23:26Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.