‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-03-25T07:23:27Z•a8f05c55c8ae47e00e2f6a9920276ebf8b408f72117226b6b13ef5241d20e01c
AI assistants','autonomous agents','insider threat','Scattered LAisuruCanisterWormDDoSI2PIoT botnetIranIran-linked actorsJackSkidKimwolfKimwolf-DortMFA bypassMicrosoft Patch Tuesday March 2026MossadStarkillerStrykerbotnet takedowncloud securitycredential relayextortionphishing-as-a-servicevulnerabilitieswiperwormzero-day
What happened
KrebsOnSecurity feed (Feb–Mar 2026) highlights multiple high-impact threats: a new worm called “CanisterWorm” that spreads via poorly secured cloud services and wipes systems with Iran time zones or Farsi defaults (apparently tied to a financially motivated extortion group attempting to insert itself into the Iran conflict); multiple large IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that compromised ~3+ million devices and were the focus of international takedowns after enabling record DDoS attacks (Kimwolf also abused the I2P anonymity network and its alleged operator “Dort” has been har-
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- a8f05c55c8ae47e00e2f6a9920276ebf8b408f72117226b6b13ef5241d20e01c
- Enrichment time
- 2026-03-25T07:23:27Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.