Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S9042
MITRE ATT&CK Malware

CanisterWorm (S9042)

ShareXLinkedInRedditHN

[CanisterWorm](https://attack.mitre.org/software/S9042) is a self-propagating malware that has been used by [TeamPCP](https://attack.mitre.org/groups/G1056) in credential harvesting and software supply chain campaigns since at least 2026. [CanisterWorm](https://attack.mitre.org/software/S9042) has used npm credentials to infect software packages and propagate across developer ecosystems. [CanisterWorm](https://attack.mitre.org/software/S9042) has a targeted wiper component and can use decentralized C2 infrastructure implemented via an Internet Computer Protocol (ICP) blockchain canister.(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)(Citation: Aikido TeamPCP Trivy MAR 2026)

Platforms: Containers, Linux

▪Techniques implemented (32)

T1059.006PythonT1613Container and Resource DiscoveryT1528Steal Application Access TokenT1124System Time DiscoveryT1569.003SystemctlT1036.004Masquerade Task or ServiceT1529System Shutdown/RebootT1105Ingress Tool TransferT1497.003Time Based ChecksT1140Deobfuscate/Decode Files or InformationT1677Poisoned Pipeline ExecutionT1033System Owner/User DiscoveryT1102.001Dead Drop ResolverT1609Container Administration CommandT1480Execution GuardrailsT1059.004Unix ShellT1053.006Systemd TimersT1543Create or Modify System ProcessT1016System Network Configuration DiscoveryT1552.004Private KeysT1083File and Directory DiscoveryT1550.001Application Access TokenT1027.009Embedded PayloadsT1036.005Match Legitimate Resource Name or LocationT1195.001Compromise Software Dependencies and Development ToolsT1059.007JavaScriptT1070.004File DeletionT1018Remote System DiscoveryT1485Data DestructionT1614.001System Language DiscoveryT1548.003Sudo and Sudo CachingT1555.006Cloud Secrets Management Stores

▪Used by groups (1)

G1056TeamPCP
S9042 on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.