A financially motivated hacking group is deploying a worm that spreads through misconfigured cloud services and destroys data on any infected system set to Iran's time zone or using Farsi as its default language, apparently exploiting the current Iran conflict to amplify disruption.