1. Home
  2. Software
  3. CanisterWorm

CanisterWorm

CanisterWorm is a self-propagating malware that has been used by TeamPCP in credential harvesting and software supply chain campaigns since at least 2026. CanisterWorm has used npm credentials to infect software packages and propagate across developer ecosystems. CanisterWorm has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.[1][2][3][4]

ID: S9042
ⓘ
Type: MALWARE
ⓘ
Platforms: Containers, Linux
Contributors: Dhanvarshini Gopalsamy, NEC Corporation India; Kamei Risa, NEC Corporation; Sareena Karapoola, NEC Corporation India
Version: 1.0
Created: 24 July 2026
Last Modified: 31 July 2026
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1548 .003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using rm –rf / --no-preserve-root. If it is not, CanisterWorm will try passwordless sudo and will run the same command.[3]
Enterprise T1059 .004 Command and Scripting Interpreter: Unix Shell

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.[3][4]
.006 Command and Scripting Interpreter: Python

CanisterWorm has used a Python script as a second-stage backdoor.[4]
.007 Command and Scripting Interpreter: JavaScript

CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.[4]
Enterprise T1609 Container Administration Command

CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.[2][3]
Enterprise T1613 Container and Resource Discovery

CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters.[2] CanisterWorm has also searched for Kubernetes pods using the command os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ.[3]
Enterprise T1543 Create or Modify System Process

CanisterWorm can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.[4]
Enterprise T1555 .006 Credentials from Password Stores: Cloud Secrets Management Stores

CanisterWorm has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.[5]
Enterprise T1485 Data Destruction

CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.[2][3]
Enterprise T1140 Deobfuscate/Decode Files or Information

CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.[4]
Enterprise T1480 Execution Guardrails

CanisterWorm can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.[3]
Enterprise T1083 File and Directory Discovery

CanisterWorm has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.[4]
Enterprise T1070 .004 Indicator Removal: File Deletion

CanisterWorm has deleted itself after execution.[3]
Enterprise T1105 Ingress Tool Transfer

CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes.[3][4] CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.[3]
Enterprise T1036 .004 Masquerading: Masquerade Task or Service

CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.[2][4]
.005 Masquerading: Match Legitimate Resource Name or Location

CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.[4]
Enterprise T1027 .009 Obfuscated Files or Information: Embedded Payloads

CanisterWorm has used embedded second stage Base64-encoded payloads.[4]
Enterprise T1677 Poisoned Pipeline Execution

CanisterWorm has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.[1][4]
Enterprise T1018 Remote System Discovery

CanisterWorm has scanned the local /24 subnet for new targets.[3]
Enterprise T1053 .006 Scheduled Task/Job: Systemd Timers

CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.[3][4]
Enterprise T1528 Steal Application Access Token

CanisterWorm has gathered cloud access tokens.[5]
Enterprise T1195 .001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools

CanisterWorm has spread through an automated process that infects and publishes npm packages.[1][4]
Enterprise T1614 .001 System Location Discovery: System Language Discovery

CanisterWorm has checked the target system's timezone (/etc/timezone, timedatectl) for Asia/Tehran or Iran and the LANG environment variable for fa_IR to identify systems matching an Iranian locale prior to deploying its destructive wiper component.[2][3]
Enterprise T1016 System Network Configuration Discovery

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.[3]
Enterprise T1033 System Owner/User Discovery

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.[3]
Enterprise T1569 .003 System Services: Systemctl

CanisterWorm has used executed systemctl --user daemon-reload to reload systemd, then enables and starts the malicious service.[4]
Enterprise T1529 System Shutdown/Reboot

CanisterWorm has forced the target system to reboot after file deletion.[3]
Enterprise T1124 System Time Discovery

CanisterWorm has checked if the target system’s time zone is "Asia/Tehran" or "Iran."[2][3]
Enterprise T1552 .004 Unsecured Credentials: Private Keys

CanisterWorm has gathered SSH private keys from the .ssh file.[3]
Enterprise T1550 .001 Use Alternate Authentication Material: Application Access Token

CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.[1][4]
Enterprise T1497 .003 Virtualization/Sandbox Evasion: Time Based Checks

CanisterWorm has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.[4]
Enterprise T1102 .001 Web Service: Dead Drop Resolver

CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.[2][3][4]

Groups That Use This Software

ID Name References
G1056 TeamPCP

TeamPCP has used CanisterWorm in credential harvesting and software supply chain campaigns since at least 2026.[1][2][3][4][5]

References

  1. Eriksen, C. (2026, March 27). Popular telnyx package compromised on PyPI by TeamPCP. Retrieved July 16, 2026.
  2. Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.
  3. Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.
  1. Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.
  2. FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026.