Aikido CanisterWorm MAR 2026

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.

CanisterWorm has scanned the local /24 subnet for new targets.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.

CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.

CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.

CanisterWorm has deleted itself after execution.

CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.

CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes. CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.

CanisterWorm has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”

CanisterWorm can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.

CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.

CanisterWorm has forced the target system to reboot after file deletion.

CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using `rm –rf / --no-preserve-root`. If it is not, CanisterWorm will try passwordless sudo and will run the same command.

CanisterWorm has gathered SSH private keys from the .ssh file.

CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.

CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters. CanisterWorm has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.

CanisterWorm has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.