‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-03-26T19:23:31Z•c52f2b027ee771e9778f531c7ccc79ea705cad697098ecdf4d4fae0d0e326ba3
AI assistantsAisuruCanisterWormDDoSI2P disruptionIoT botnetIranIran‑linked actorsJackSkidKimwolfMFA bypassMicrosoft Patch Tuesday March 2026MossadScattered Lapsus ShinyHuntersStarkillerStrykeragent securitybotmaster Dortcloud compromisecredential relayextortionphishing‑as‑a‑serviceswattingvulnerability managementwiper
What happened
The feed highlights multiple high-impact cyber threats from early 2026: a new worm called “CanisterWorm” that spreads via poorly secured cloud services and wipes systems set to Iran time zone or Farsi; coordinated law‑enforcement disruption of four massive IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that had compromised >3 million devices and enabled record DDoS attacks; Kimwolf’s ongoing disruptions (including attacks on the I2P network) and doxxing/SWAT harassment by its alleged operator “Dort”; an Iran‑linked wiper claimed against medical device firm Stryker; a stealthy phishing‑as‑a‑服务
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- c52f2b027ee771e9778f531c7ccc79ea705cad697098ecdf4d4fae0d0e326ba3
- Enrichment time
- 2026-03-26T19:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.