‘CanisterWorm’ Springs Wiper Attack Targeting Iran

2026-04-05T19:23:28Zea74fbfc9ef5a0468cda00ecad91cb5f2959daa17ee585b7ac6b55575f0608e8
AI assistantsAisuruCanisterWormDDoSIoT botnetIranJackSkidKimwolfMFA bypassMicrosoft Patch TuesdayMossadScattered Lapsus ShinyHuntersStarkillerStrykercredential theftextortionhacktivistinsider risklaw-enforcement takedownnation-state-linkedphishing-as-a-servicevulnerabilitieswiperwormzero-day

What happened

A collection of KrebsOnSecurity reports describing multiple high-risk campaigns and ecosystem developments: a financially motivated group unleashed “CanisterWorm,” a wormy wiper that spreads via poorly secured cloud services and targets systems using Iran time zone or Farsi locale; Iran-linked hacktivists claim a destructive wiper attack against medical device vendor Stryker; major IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) compromised millions of devices enabling record DDoS activity and prompted a multinational law-enforcement disruption; Kimwolf remains active and disruptive (including

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
krebs_on_security
Record identifier
ea74fbfc9ef5a0468cda00ecad91cb5f2959daa17ee585b7ac6b55575f0608e8
Enrichment time
2026-04-05T19:23:28Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.