S9042: CanisterWorm

S9042: CanisterWorm describes [CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) in credential harvesting and software supply chain campaigns since at least 2026. [CanisterWorm](https://attack.mitre.org/software/S9042) has used npm credentials to infect software packages and propagate across developer ecosystems. [CanisterWorm](https://attack.mitre.org/software/S9042) has a targeted wiper component and can use decentralized C2 infrastructur...

Executive priority

S9042: CanisterWorm is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S9042: CanisterWorm by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Containers, Linux), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Cloud control-plane, SaaS audit, and container platform logs
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S9042: CanisterWorm appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

CanisterWorm

CanisterWorm is a self-propagating malware that has been used by TeamPCP in credential harvesting and software supply chain campaigns since at least 2026. CanisterWorm has used npm credentials to infect software packages and propagate across developer ecosystems. CanisterWorm has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques32 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1677	Poisoned Pipeline Execution	CanisterWorm has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.[1][4]
Enterprise	T1195.001	Compromise Software Dependencies and Development ToolsSub-technique	CanisterWorm has spread through an automated process that infects and publishes npm packages.[1][4]
Enterprise	T1485	Data Destruction	CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.[2][3]
Enterprise	T1102.001	Dead Drop ResolverSub-technique	CanisterWorm can periodically poll a decentralized Internet Computer Protocol (ICP) canister to retrieve a dynamic URL for payload delivery.[2][3][4]
Enterprise	T1036.004	Masquerade Task or ServiceSub-technique	CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.[2][4]
Enterprise	T1124	System Time Discovery	CanisterWorm has checked if the target system’s time zone is “Asia/Tehran” or “Iran.”[2][3]
Enterprise	T1529	System Shutdown/Reboot	CanisterWorm has forced the target system to reboot after file deletion.[3]
Enterprise	T1053.006	Systemd TimersSub-technique	CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.[3][4]
Enterprise	T1070.004	File DeletionSub-technique	CanisterWorm has deleted itself after execution.[3]
Enterprise	T1548.003	Sudo and Sudo CachingSub-technique	CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using `rm –rf / --no-preserve-root`. If it is not, CanisterWorm will try passwordless sudo and will run the same command.[3]
Enterprise	T1552.004	Private KeysSub-technique	CanisterWorm has gathered SSH private keys from the .ssh file.[3]
Enterprise	T1018	Remote System Discovery	CanisterWorm has scanned the local /24 subnet for new targets.[3]
Enterprise	T1033	System Owner/User Discovery	CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.[3]
Enterprise	T1016	System Network Configuration Discovery	CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.[3]
Enterprise	T1059.004	Unix ShellSub-technique	CanisterWorm has used shell commands to enable and start the malicious systemd service for execution and persistence.[3][4]
Enterprise	T1543	Create or Modify System Process	CanisterWorm can establish persistence in CI/CD environments by launching a background process (deploy.js) with stolen tokens.[4]
Enterprise	T1140	Deobfuscate/Decode Files or Information	CanisterWorm has decoded a long Base64 string to obtain a Python script for its second-stage payload.[4]
Enterprise	T1059.006	PythonSub-technique	CanisterWorm has used a Python script as a second-stage backdoor.[4]
Enterprise	T1569.003	SystemctlSub-technique	CanisterWorm has used executed `systemctl --user daemon-reload` to reload systemd, then enables and starts the malicious service.[4]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	CanisterWorm has mimicked legitimate PostgreSQL components (pgmon, pglog, and .pg_state) to masquerade malicious files.[4]
Enterprise	T1027.009	Embedded PayloadsSub-technique	CanisterWorm has used embedded second stage Base64-encoded payloads.[4]
Enterprise	T1528	Steal Application Access Token	CanisterWorm has gathered cloud access tokens.CitationFBI TeamPCP JUL 2026
Enterprise	T1555.006	Cloud Secrets Management StoresSub-technique	CanisterWorm has gathered credentials from Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure.CitationFBI TeamPCP JUL 2026
Enterprise	T1480	Execution Guardrails	CanisterWorm can base execution on specific conditions including halting its wiper component if Kubernetes is not found and if the target is not located in Iran.[3]
Enterprise	T1059.007	JavaScriptSub-technique	CanisterWorm can leverage stolen tokens to execute Javascsript (deploy.js) for self-propagation.[4]
Enterprise	T1105	Ingress Tool Transfer	CanisterWorm has downloaded and executed binaries from dead drop URLs retrieved from ICP canister C2 nodes.[3][4] CanisterWorm has also downloaded kubectl to compromised environments if it was not already installed.[3]
Enterprise	T1497.003	Time Based ChecksSub-technique	CanisterWorm has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.[4]
Enterprise	T1609	Container Administration Command	CanisterWorm can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.[2][3]
Enterprise	T1613	Container and Resource Discovery	CanisterWorm has performed environment fingerprinting to identify Kubernetes clusters.[2] CanisterWorm has also searched for Kubernetes pods using the command ` os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ `.[3]
Enterprise	T1083	File and Directory Discovery	CanisterWorm has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.[4]
Enterprise	T1550.001	Application Access TokenSub-technique	CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.[1][4]
Enterprise	T1614.001	System Language DiscoverySub-technique	CanisterWorm has checked the target system's timezone `(/etc/timezone, timedatectl)` for `Asia/Tehran` or `Iran` and the `LANG` environment variable for `fa_IR` to identify systems matching an Iranian locale prior to deploying its destructive wiper component.[2][3]

Associated objects

Groups, software, and campaigns

G1056: TeamPCP

TeamPCP is a financially-motivated, cloud-native threat group that has been active since at least September 2025. Initially focused on ransomware and cryptocurrency theft, TeamPCP shifted in early 2026 to systematic, worm-driven credential theft and software supply chain attacks targeting Continuous Integration and Continuous Delivery (CI/CD) workflows. TeamPCP has monetized access through extortion and through partnerships with ransomware actors including Vect and CipherForce.[1][2][3][4][5][6]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.0
Created: Jul 24, 2026, 17:52 UTC (UTC+00:00)
Modified: Jul 31, 2026, 02:39 UTC (UTC+00:00)
Raw hash: 0bf1e2fc686d00b1...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.0	Jul 31, 2026, 02:39 UTC (UTC+00:00)	Current bundle	`0bf1e2fc686d…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Aikido TeamPCP Telnyx MAR 2026
Eriksen, C. (2026, March 27). Popular telnyx package compromised on PyPI by TeamPCP. Retrieved July 16, 2026.
Open source URL
[2]
Palo Alto TeamPCP MAR 2026
Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.
Open source URL
[3]
Aikido CanisterWorm MAR 2026
Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.
Open source URL
[4]
Aikido TeamPCP Trivy MAR 2026
Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.
Open source URL
[5]
mitre-attackS9042
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use