CanisterWorm Wiper Strikes Iranian Critical Infrastructure

Security researchers have confirmed that the CanisterWorm wiper has been actively targeting Iranian critical infrastructure. The payload uses a multi‑stage infection chain: initial reconnaissance, credential harvesting, lateral movement, and finally a destructive payload that overwrites files and disables system services. The wiper is engineered to evade sandbox analysis and can spread across Windows domains without user interaction.

The attack has already caused data loss and service outages at several high‑value sites, prompting national CERTs to issue alerts and share indicators of compromise. Defenders must update detection rules, monitor for the disclosed IOCs, and enforce strict credential hygiene to prevent lateral movement, as similar tactics could be repurposed against other sectors worldwide.

Categories: Malware & Ransomware, Threat Intelligence

Source: Read original article