Aikido Reports TeamPCP Kubernetes Campaign With Iran-Targeted Wiper
Summary
Aikido says TeamPCP’s Kubernetes campaign installs CanisterWorm on non-Iranian nodes and uses a destructive payload on systems matching Iran’s timezone and locale. Variants also spread via SSH or unauthenticated Docker API access.
Key points
- Aikido links the campaign to CanisterWorm through its shared ICP canister, command-and-control infrastructure, backdoor code, and /tmp/pglog drop path.
- On systems matching Iran’s timezone and locale, the malware deploys a privileged Kubernetes DaemonSet whose Alpine pods delete top-level host directories and reboot the machine.
- On Iranian systems without Kubernetes, the payload attempts to delete files accessible to the current user; it attempts passwordless sudo if root privileges are unavailable.
- On non-Iranian Kubernetes nodes, a separate DaemonSet installs a Python backdoor as a persistent systemd service.
- A reported variant propagates via SSH, parsing authentication logs for credentials and using stolen private keys.
- Aikido cites outbound SSH with StrictHostKeyChecking=no, Docker API access on port 2375, and privileged Alpine containers as indicators of activity.
Article Details
- Attack Vectors
- Deploys privileged Kubernetes DaemonSets with the host root filesystem mounted to wipe Iranian-configured systems or install a persistent Python backdoor on other nodes.
- On Iranian systems without Kubernetes, runs a destructive rm command and attempts passwordless sudo if root privileges are unavailable.
- Some variants propagate over SSH by parsing authentication logs for credentials and using stolen private keys.
- Some variants access an unauthenticated Docker API on port 2375 across the local subnet and use privileged Alpine containers with the host root mounted.
- Defensive Notes
- Monitor for outbound SSH connections using StrictHostKeyChecking=no from compromised hosts.
- Review Docker API exposure and access on port 2375, especially across local subnets.
- Investigate unexpected privileged DaemonSets named Host-provisioner-iran or host-provisioner-std, and activity involving the /tmp/pglog path.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io | Aikido identifies this ICP canister as the C2 used by the CanisterWorm backdoor. |
MITRE ATT&CK
T1021.004 · SSHSome variants propagate to other systems over SSH using credentials or stolen private keys.T1059.004 · Unix ShellThe destructive payload runs the rm command to delete files on Iranian-configured systems without Kubernetes.T1210 · Exploitation of Remote ServicesSome variants exploit unauthenticated Docker API access on port 2375 across the local subnet.T1485 · Data DestructionThe payload deletes host directories or files on systems identified as configured for Iran.T1543.002 · Systemd ServiceOn non-Iranian Kubernetes nodes, the backdoor is installed as a persistent systemd service.T1552.004 · Private KeysSome variants use stolen private keys for SSH propagation.T1610 · Deploy ContainerThe malware deploys privileged Alpine containers through Kubernetes DaemonSets.T1611 · Escape to HostPrivileged containers mount the host root filesystem and use that access to modify or delete host files.
Threat Actors
Malware
Products
KubernetesTeamPCP is conducting a campaign against Kubernetes clusters that installs the CanisterWorm backdoor on non-Iranian systems and deploys a geopolitically targeted destructive payload that wipes machines configured forTrivyAikido links this activity to the Trivy supply-chain compromise and notes variants that spread via SSH and exploit unauthenticated Docker API access.