Malware - TeamPCP Deploys Iran-Targeted Wiper in Attacks
Basically, a hacker group is using a virus to erase data on computers in Iran.
TeamPCP has launched a wiper malware targeting Iranian Kubernetes systems. This attack raises serious concerns about data loss and escalating cyber warfare. Organizations must act quickly to secure their systems.
What Happened
The hacking group TeamPCP has launched a new campaign targeting Kubernetes clusters with a malicious script designed to wipe all data from machines configured for Iran. This attack is particularly alarming as it represents a shift towards geopolitical cyber warfare. The malware, which is capable of identifying systems based on their timezone and locale, can execute destructive commands, effectively erasing critical data.
This campaign follows TeamPCP's previous exploits, including a supply-chain attack on the Trivy vulnerability scanner and an NPM-based campaign known as CanisterWorm. Researchers from Aikido have noted that the new malware shares similarities with the CanisterWorm incidents, using the same command-and-control (C2) infrastructure and backdoor code. However, the introduction of a destructive payload specifically targeting Iranian systems marks a new level of aggression.
Who's Being Targeted
The primary targets of this malware are systems configured for Iran, regardless of whether they are running Kubernetes. The malware is built to identify machines based on their locale and timezone, and if it detects an Iranian configuration, it unleashes a destructive payload. This means that even systems without Kubernetes can be affected, leading to potential data loss for individuals and organizations operating in the region.
The implications of this targeted attack are significant. It not only threatens the integrity of data for Iranian users but also raises concerns about the escalation of cyber conflicts. As geopolitical tensions rise, such attacks could become more common, affecting a wider range of targets.
Signs of Infection
Indicators of this malware's activity include the deployment of a DaemonSet named ‘Host-provisioner-iran’ in the Kubernetes environment. This DaemonSet runs a container that deletes all top-level directories on the host filesystem and forces a reboot. If the system is not identified as Iranian, the malware instead installs a backdoor for future access.
Researchers have identified key signs to watch for, including:
- Outbound SSH connections with
StrictHostKeyChecking+nofrom compromised hosts. - Outbound connections to the Docker API on port 2375 across the local subnet.
- Privileged Alpine containers running via an unauthenticated Docker API.
These indicators can help organizations detect potential breaches and take immediate action.
How to Protect Yourself
To safeguard against this emerging threat, organizations should implement several protective measures. First, ensure that Kubernetes clusters are properly configured with security best practices. This includes restricting access to the Docker API and monitoring for unusual outbound connections.
Additionally, organizations should regularly audit their systems for vulnerabilities and apply patches promptly. Educating employees about the risks of geopolitical cyber threats is also crucial. By being vigilant and proactive, organizations can reduce the risk of falling victim to such destructive malware campaigns.
BleepingComputer