A group of cybercriminals focused on extortion and data theft has launched a destructive campaign using a worm designed to identify and erase data on systems configured for Iran's timezone or using Farsi as the default language. The malware spreads by exploiting inadequately protected cloud services, according to security researchers tracking the activity.
The destructive operation emerged over the weekend and originated from TeamPCP, a relatively recent player in the cybercriminal landscape. Beginning in December 2025, this group has been compromising cloud environments through a self-replicating worm that targets exposed Docker APIs, Kubernetes clusters, Redis servers, and the React2Shell vulnerability. Following initial compromise, TeamPCP moves through victim networks to harvest login credentials and demand ransom payments via Telegram.
Security firm Flare released an analysis of TeamPCP in January, revealing that the group prioritizes exposed control planes over endpoint exploitation, concentrating efforts on cloud infrastructure rather than individual machines. The firm's data showed Azure and AWS represented 97% of compromised servers, with Azure accounting for 61% and AWS for 36% of incidents.
TeamPCP's strength does not come from novel exploits or original malware, but from the large-scale automation and integration of well-known attack techniques. The group industrializes existing vulnerabilities, misconfigurations, and recycled tooling into a cloud-native exploitation platform that turns exposed infrastructure into a self-propagating criminal ecosystem.
Assaf Morag, Flare
On March 19, TeamPCP executed a supply chain compromise targeting Trivy, a vulnerability scanner maintained by Aqua Security. The attackers injected credential-harvesting malware into official releases distributed through GitHub actions. Aqua Security subsequently removed the malicious files, though security researchers at Wiz confirmed the attackers successfully published compromised versions that extracted SSH keys, cloud credentials, Kubernetes tokens, and cryptocurrency wallets from users.
During the following weekend, TeamPCP repurposed the same technical infrastructure from the Trivy attack to distribute a new malicious payload. This payload executes a data-wiping routine if it detects the user's timezone and locale settings correspond to Iran, according to Charlie Eriksen, a security researcher at Aikido. In analysis published Sunday, Eriksen explained that if the wiper component identifies an Iranian victim with Kubernetes cluster access, it will destroy data across every node in that cluster.
If it doesn't it will just wipe the local machine.
Charlie Eriksen, Aikido
Aikido has designated TeamPCP's infrastructure as "CanisterWorm" due to the group's use of Internet Computer Protocol (ICP) canisters for orchestrating operations. These canisters function as tamperproof, blockchain-based smart contracts combining executable code with data. ICP canisters can serve web content directly to users, and their distributed structure provides resistance to removal efforts. The canisters remain accessible as long as operators continue paying virtual currency fees to maintain them online.
Members of TeamPCP have been publicizing their activities in a Telegram group, claiming to have extracted substantial quantities of sensitive information from major organizations, including a large multinational pharmaceutical company. Eriksen noted that when the group gained access to Aqua Security a second time, they compromised multiple GitHub accounts and used them to flood repositories with spam messages.
When they compromised Aqua a second time, they took a lot of GitHub accounts and started spamming these with junk messages. It was almost like they were just showing off how much access they had. Clearly, they have an entire stash of these credentials, and what we've seen so far is probably a small sample of what they have.
Charlie Eriksen, Aikido
Security researchers suggest that the GitHub spam campaign may serve a strategic purpose: keeping malware-infected code packages visible in GitHub search results. In a recent newsletter titled "GitHub is Starting to Have a Real Malware Problem," Catalin Cimpanu of Risky Business documented how attackers frequently push trivial commits to repositories or purchase GitHub stars and engagement metrics to maintain malicious packages at the top of search rankings.
This weekend's incident represents the second major supply chain attack on Trivy within two months. In late February, the tool fell victim to HackerBot-Claw, an automated attack that mass-exploited misconfigured GitHub Actions workflows to harvest authentication tokens.
Eriksen indicated that TeamPCP likely leveraged access obtained during the initial Aqua Security breach to execute this weekend's attack. However, he cautioned that determining whether the wiper payload actually succeeded in destroying data on victim systems remains difficult, and the malicious code was only active briefly over the weekend.
They've been taking [the malicious code] up and down, rapidly changing it adding new features.
Charlie Eriksen, Aikido
Eriksen noted that when the malicious canister was not distributing malware, it redirected visitors to a Rick Roll video on YouTube. He suggested the Iran-focused wiper component may be primarily a publicity stunt designed to generate attention.
It's a little all over the place, and there's a chance this whole Iran thing is just their way of getting attention. I feel like these people are really playing this Chaotic Evil role here.
Charlie Eriksen, Aikido
Cimpanu observed that supply chain attacks have become increasingly frequent as threat actors recognize their efficiency, documenting numerous incidents since 2024. While security organizations have demonstrated competence in identifying these attacks, he emphasized the need for GitHub's security team to strengthen defenses.
While security firms appear to be doing a good job spotting this, we're also gonna need GitHub's security team to step up. Unfortunately, on a platform designed to copy (fork) a project and create new versions of it (clones), spotting malicious additions to clones of legitimate repos might be quite the engineering problem to fix.
Catalin Cimpanu, Risky Business
Wiz reported that TeamPCP also distributed credential-stealing malware to KICS, a vulnerability scanner from Checkmarx. The scanner's GitHub Action was compromised between 12:58 and 16:50 UTC on March 23rd.
Source: Krebs on Security