Procedure examples

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.

CanisterWorm has scanned the local /24 subnet for new targets.

CanisterWorm has used embedded second stage Base64-encoded payloads.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.

CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.

CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.

CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.

CanisterWorm has used a Python script as a second-stage backdoor.

CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.

CanisterWorm has deleted itself after execution.

CanisterWorm has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.

CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.

CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes. CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.

CanisterWorm has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”

CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.

CanisterWorm has spread through an automated process that infects and publishes npm packages.

CanisterWorm can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.

CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.

CanisterWorm has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.

CanisterWorm has gathered cloud access tokens.

CanisterWorm has forced the target system to reboot after file deletion.

CanisterWorm can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.

CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using `rm –rf / --no-preserve-root`. If it is not, CanisterWorm will try passwordless sudo and will run the same command.

CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.

CanisterWorm has gathered SSH private keys from the .ssh file.

CanisterWorm has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.

CanisterWorm has used executed `systemctl --user daemon-reload` to reload systemd, then enables and starts the malicious service.

CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.

CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters. CanisterWorm has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.

CanisterWorm has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.

CanisterWorm has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.