MITRE ATT&CKsoftware (malware)
S9042 CanisterWorm
- Domain
- enterprise
- Platforms
- Containers, Linux
- Version
- 1.0
- Created
- 2026-07-24
Description
CanisterWorm is a self-propagating malware that has been used by TeamPCP in credential harvesting and software supply chain campaigns since at least 2026. CanisterWorm has used npm credentials to infect software packages and propagate across developer ecosystems. CanisterWorm has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.
Related
Uses · MITRE ATT&CK (32)
- T1677 Poisoned Pipeline Execution technique
- T1569.003 Systemctl sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1027.009 Embedded Payloads sub-technique
- T1614.001 System Language Discovery sub-technique
- T1613 Container and Resource Discovery technique
- T1609 Container Administration Command technique
- T1053.006 Systemd Timers sub-technique
- T1059.007 JavaScript sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1059.004 Unix Shell sub-technique
- T1059.006 Python sub-technique
- T1497.003 Time Based Checks sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1552.004 Private Keys sub-technique
- T1070.004 File Deletion sub-technique
- T1548.003 Sudo and Sudo Caching sub-technique
- T1550.001 Application Access Token sub-technique
- T1543 Create or Modify System Process technique
- T1529 System Shutdown/Reboot technique
- T1528 Steal Application Access Token technique
- T1485 Data Destruction technique
- T1480 Execution Guardrails technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1018 Remote System Discovery technique
- T1033 System Owner/User Discovery technique
- T1083 File and Directory Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G1056 TeamPCP group
References
- https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise Aikido TeamPCP Trivy MAR 2026
- https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran Aikido CanisterWorm MAR 2026
- https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm Aikido TeamPCP Telnyx MAR 2026
- https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/ Palo Alto TeamPCP MAR 2026