Know What's Happening in Industry

TeamPCP Deploys Iran-Targeted Wiper in Kubernetes Attacks

TeamPCP, the group behind the recent Trivy supply‑chain breach and the CanisterWorm campaign, has rolled out a new destructive payload that targets Kubernetes clusters configured for Iran. The malware deploys a privileged DaemonSet called "Host‑provisioner‑iran" to wipe host files and reboot the system, while non‑Iranian nodes receive a persistent Python backdoor. On machines without Kubernetes, the script runs a root‑level rm‑rf command to erase all data. Aikido researchers also observed a variant that spreads via SSH and unauthenticated Docker APIs, expanding its reach beyond Kubernetes environments.