‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-03-26T07:23:28Z•974a79d6f42454ece76b99a47423c3f00b77abc7fe61e46b22b565a8eda4ad9d
AI assistants security risk','insider risk','autonomous agents'AisuruCanisterWormDDoSI2PIoT botnetIranIran-backedJackSkidKimwolfMFA bypassMicrosoft vulnerabilitiesMossadPatch TuesdayStarkillerStrykerbotnet takedowncloud securitycredential theftdata wipingextortionphishingphishing-as-a-servicewiperzero-day
What happened
Collection of KrebsOnSecurity reports from Feb–Mar 2026 describing multiple high-impact threats: a new wiper worm dubbed “CanisterWorm” that spreads via poorly secured cloud services and selectively wipes systems using Iran time zone or Farsi locale; claims by Iran-linked actors of a destructive wiper attack against medical device vendor Stryker; disruption/takedown of four massive IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that abused millions of devices to mount record DDoS attacks; and continued Kimwolf activity including abuse of the I2P anonymity network and harassment of researchers
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 974a79d6f42454ece76b99a47423c3f00b77abc7fe61e46b22b565a8eda4ad9d
- Enrichment time
- 2026-03-26T07:23:28Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.