CanisterWorm: Wiping Logic & Cloud Worming Mechanics

Just caught the KrebsOnSecurity piece on 'CanisterWorm'. It’s a fascinating shift in TTPs—a financially motivated group using a wormable wiper, likely trying to mask their greed under the guise of geopolitical conflict.

The malware targets systems with an Asia/Tehran time zone or Farsi set as the default language. While the wiper payload is specific, the propagation vector via poorly secured cloud services is a global concern. If your cloud permissions are lax, you could be hosting the worm even if you aren't the target.

The Check The locale check is surprisingly straightforward. It likely queries system settings before detonating. Here is a conceptual Python snippet of what that logic looks like:

import locale
import datetime

# Check for Farsi locale
sys_locale = locale.getdefaultlocale()[0]
if sys_locale.startswith('fa'):
    return "WIPE_TARGET"

# Check for Iran Timezone
tz = datetime.datetime.now(datetime.timezone.utc).astimezone().tzname()
if 'Iran' in str(tz) or 'Tehran' in str(tz):
    return "WIPE_TARGET"


**Hunting**
We need to watch for processes querying these specific settings. If you aren't in the region, seeing these calls is a massive red flag for a scanning malware instance.

DeviceProcessEvents
| where ProcessCommandLine contains "Get-WinSystemLocale" 
   or ProcessCommandLine contains "Get-TimeZone"
| where ProcessCommandLine contains "fa" or ProcessCommandLine contains "Tehran"

Has anyone started seeing anomalous API calls in their cloud logs that might indicate lateral movement attempts for this worm? I'm curious if others are seeing the propagation attempts in the wild.