‘CanisterWorm’ Springs Wiper Attack Targeting Iran
2026-04-05T19:23:28Z•ea74fbfc9ef5a0468cda00ecad91cb5f2959daa17ee585b7ac6b55575f0608e8
AI assistantsAisuruCanisterWormDDoSIoT botnetIranJackSkidKimwolfMFA bypassMicrosoft Patch TuesdayMossadScattered Lapsus ShinyHuntersStarkillerStrykercredential theftextortionhacktivistinsider risklaw-enforcement takedownnation-state-linkedphishing-as-a-servicevulnerabilitieswiperwormzero-day
What happened
A collection of KrebsOnSecurity reports describing multiple high-risk campaigns and ecosystem developments: a financially motivated group unleashed “CanisterWorm,” a wormy wiper that spreads via poorly secured cloud services and targets systems using Iran time zone or Farsi locale; Iran-linked hacktivists claim a destructive wiper attack against medical device vendor Stryker; major IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) compromised millions of devices enabling record DDoS activity and prompted a multinational law-enforcement disruption; Kimwolf remains active and disruptive (including
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- ea74fbfc9ef5a0468cda00ecad91cb5f2959daa17ee585b7ac6b55575f0608e8
- Enrichment time
- 2026-04-05T19:23:28Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.