TeamPCP Deploys Iran-Targeted Wiper in Kubernetes Attacks

Why It Matters

The attack demonstrates a shift toward geopolitically motivated cyber‑warfare, forcing organizations to harden cloud‑native infrastructure and monitor for targeted wiper behavior. It raises the stakes for any entity with Iranian ties or assets, highlighting the need for rapid detection and containment.

Key Takeaways

• TeamPCP adds Iran‑specific wiper to Kubernetes attacks.
• Uses DaemonSet ‘Host‑provisioner‑iran’ to delete host files.
• Non‑Iranian nodes receive persistent Python backdoor.
• Malware also spreads via SSH and unauthenticated Docker API.
• Researchers flag outbound SSH with StrictHostKeyChecking=no.

Pulse Analysis

The emergence of a geo‑targeted wiper in the hands of TeamPCP underscores a growing trend where nation‑state interests intersect with criminal cyber‑operations. After compromising the open‑source Trivy scanner and launching the CanisterWorm NPM campaign, the group now leverages Kubernetes’ native orchestration to deliver a destructive payload aimed specifically at Iranian systems. By embedding the same ICP canister C2 infrastructure, the attackers maintain a low‑profile command channel while executing a highly selective kill‑switch that wipes data and forces reboots, a tactic that could cripple critical infrastructure if left unchecked.

From a technical standpoint, the malware exploits privileged DaemonSets to mount the host filesystem inside Alpine containers, granting it unfettered access to delete top‑level directories. The dual‑mode operation—wiping Iranian hosts and installing a Python backdoor on others—demonstrates sophisticated conditional logic based on timezone and locale detection. A later variant abandons Kubernetes lateral movement in favor of SSH propagation, parsing authentication logs for valid credentials and leveraging stolen private keys. Outbound connections with "StrictHostKeyChecking=no" and unauthenticated Docker API calls on port 2375 serve as reliable indicators for security teams monitoring for this activity.

For defenders, the campaign highlights the necessity of zero‑trust controls across container runtimes and SSH access. Organizations should enforce strict authentication for Docker APIs, disable privileged container defaults, and regularly audit DaemonSet deployments in the kube‑system namespace. Continuous monitoring for anomalous outbound SSH flags and unexpected host‑path mounts can provide early warning. As geopolitical cyber threats become more precise, integrating threat intelligence on actors like TeamPCP into security operations will be essential to mitigate the risk of targeted data destruction and persistent backdoor implantation.