Self-propagating malware poisons open source software and wipes Iran-based PCs
AI summary of the linked articleCanisterWorm, a self-propagating malware that Aikido researchers attribute to the group TeamPCP, targets CI/CD pipelines and spreads through npm tokens that infected systems can access. Aikido researcher Charlie Eriksen said the canister was taken down Sunday night and is no longer available. The worm was later updated with a wiper, named Kamikaze, that activates only on machines in the Iranian timezone or configured for Iran. Eriksen said there is no indication yet that it caused actual damage to Iranian machines, but that it had "clear potential for large-scale impact if it achieves active spread." |
Recommended by 1 curator |
1 comment  timSubmitter The worm was controlled by an uncommon mechanism that was designed to be tamper proof. It used an Internet Computer Protocol-based canister, a form of self-enforcing smart contract designed to be impossible for third parties to take down or alter. The canister could point to ever-changing URLs for servers hosting malicious binaries. By giving the attackers a way for the worm to find control servers, the attackers can constantly swap out URLs at any time. Infected machines reported to the canister once every 50 minutes. In an email, Aikido researcher Charlie Eriksen said the canister was taken down Sunday night and is no longer available. Wow crypto is such a disappointment |
More from arstechnica.com on Kiwi News
|