TeamPCP deploys Iran-targeted wiper in Kubernetes attacks
Recorded: March 24, 2026, 2:22 a.m.
| Original | Summarized |
TeamPCP deploys Iran-targeted wiper in Kubernetes attacks News Featured Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Microsoft Azure Monitor alerts abused for callback phishing attacks Musician admits to $10M streaming royalty fraud using AI bots FBI links Signal phishing attacks to Russian intelligence services OpenAI rolls out ChatGPT Library to store your personal files Mazda discloses security breach exposing employee and partner data Tycoon2FA phishing platform returns after recent police disruption TeamPCP deploys Iran-targeted wiper in Kubernetes attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityTeamPCP deploys Iran-targeted wiper in Kubernetes attacks TeamPCP deploys Iran-targeted wiper in Kubernetes attacks By Bill Toulas March 23, 2026 The TeamPCP hacking group is targeting Kubernetes clusters with a malicious script that wipes all machines when it detects systems configured for Iran. TeamPCP wiping Iranian systems with no Kubernetessource: Aikido Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Backdoor Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Microsoft: March Windows updates break Teams, OneDrive sign-ins Microsoft Azure Monitor alerts abused for callback phishing attacks Trivy vulnerability scanner breach pushed infostealer via GitHub Actions Sponsor Posts AI is a data-breach time bomb: Read the new report Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. Secure your AI agents without sacrificing speed. Are refund fraud methods targeting your brand? You can monitor the underground for these threats. Overdue a password health-check? Audit your Active Directory for free Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
TeamPCP, a known hacking group, has recently deployed a sophisticated and targeted wiper campaign specifically designed to eliminate systems identified as originating from Iran, utilizing Kubernetes clusters as a central component of their operation. This activity, detailed by application security company Aikido, represents a significant escalation in TeamPCP’s tactics and highlights the evolving nature of cyber threats. The core of the campaign revolves around a command-and-control (C2) infrastructure, backdoor code, and a drop path, all mirroring elements previously observed in the ‘CanisterWorm’ supply-chain attack and the ‘CanisterWorm’ NPM-based campaign. However, the new iteration introduces a geographically-targeted destructive payload, distinguishing it from prior TeamPCP activities. The malware’s primary objective is to erase all data on machines matching Iran’s timezone and locale. If both the geolocation and Kubernetes presence are confirmed, the script initiates a ‘Host-provisioner-iran’ DaemonSet, leveraging privileged containers and mounting the host root filesystem into /mnt/host. Within these containers, the ‘kamikaze’ Alpine image executes a destructive command sequence, deleting all top-level directories on the affected host and forcing a reboot. Crucially, when Kubernetes is present but the system lacks Iranian characteristics, the malware deploys a ‘host-provisioner-std’ DaemonSet. This variant focuses on installing a Python backdoor onto the host filesystem and establishing it as a persistent systemd service. This differs significantly from their earlier methodology, which primarily involved widespread destruction. A critical distinction is made by Aikido; the malware’s operational strategy adapts to the environment it encounters. If Kubernetes is not present, the malware employs a devastating tactic—complete data erasure—utilizing the `rm -rf/` command with the `--no-preserve-root` flag, or attempts passwordless sudo if root privileges are unavailable. Further complicating the threat, a newer version of this malware has omitted Kubernetes-based lateral movement, shifting towards a more adaptable strategy. This version leverage SSH propagation, exploiting authentication logs and stolen private keys for network expansion. The researchers identified specific indicators of compromise (IOCs) including outbound SSH connections with ‘StrictHostKeyChecking+no’, outbound connections to the Docker API on port 2375, and privileged Alpine containers via an unauthenticated Docker API with / mounted as a hostPath. Aikido stresses that this campaign represents a notable departure in TeamPCP's playbook, incorporating geopolitical targeting which adds a distinctive element to the group's attack methods. The response to this evolving threat necessitates a heightened level of vigilance, particularly within organizations utilizing Kubernetes environments. The group's methods, as detailed by Aikido, include identifying systems on Iranian timezones regardless of Kubernetes use. |