Threat intelligence / Malware

CanisterWorm

[CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) in credential harvesting and software supply chain campaigns since at least 2026. [CanisterWorm](https://attack.mitre.org/software/S9042) has used npm credentials to infect software packages and propagate across developer ecosystems. [CanisterWorm](https://attack.mitre.org/software/S9042) has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) in credential harvesting and software supply chain campaigns since at least 2026. [CanisterWorm](https://attack.mitre.org/software/S9042) has used npm credentials to infect software packages and propagate across developer ecosystems. [CanisterWorm](https://attack.mitre.org/software/S9042) has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)

Labels

malware

33 recorded

Relationships

uses

to Application Access Token

Technique

uses

to Cloud Secrets Management Stores

Technique

uses

to Compromise Software Dependencies and Development Tools

Technique

uses

to Container Administration Command

Technique

uses

to Container and Resource Discovery

Technique

uses

to Create or Modify System Process

Technique

uses

to Data Destruction

Technique

uses

to Dead Drop Resolver

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Embedded Payloads

Technique

uses

to Execution Guardrails

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Poisoned Pipeline Execution

Technique

uses

to Private Keys

Technique

uses

Technique

uses

to Remote System Discovery

Technique

uses

to Steal Application Access Token

Technique

uses

to Sudo and Sudo Caching

Technique

uses

Technique

uses

to Systemd Timers

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Shutdown/Reboot

Technique

uses

to System Time Discovery

Technique

uses

to Time Based Checks

Technique

uses

Technique

uses

Group

5 external

References

mitre-attack

S9042

Aikido TeamPCP Trivy MAR 2026

https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise

Aikido CanisterWorm MAR 2026

https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran

Aikido TeamPCP Telnyx MAR 2026

https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm

Palo Alto TeamPCP MAR 2026

https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/