CrowdStrike has shared details of a coordinated operation used to disable the Glassworm botnet, which targets software developers and leverages open-source ecosystems to deploy malware.
The CrowdStrike Counter Adversary Operations team, in partnership with Google and the Shadowserver Foundation, took down all four C2 centers of the Glassworm network on 26 May by disrupting all lines of communication between Glassworm’s controllers and infected systems. This prevented additional malicious payloads from being delivered.
CrowdStrike said Glassworm was a worldwide attack against software developers via the open-source software ecosystem. The threat actors employed malicious VSCode plug-ins, poisoned Python and npm packages, and compromised GitHub repos to deploy a malware strain that could exfiltrate credentials and establish remote access.
The botnet’s robustness was a result of its adoption of several Command & Control channels, namely, the Solana Blockchain, BitTorrent DHT network, Google Calendar, and Virtual Private Servers. CrowdStrike stated that it simultaneously disrupted all four channels to prevent the operators from switching to a backup infrastructure for their operations.
This takedown happened at a time when there is rising awareness regarding the attacks conducted by hackers against developers and software supply chain networks. Hackers no longer go after user endpoints; they target the tools and libraries developers use to infect other organizations that may be using these components.
CrowdStrike stated that this takedown removed the Glassworm botnet from the attackers’ side. Nevertheless, CrowdStrike warned developers and organizations impacted by this attack that further investigation and cleanup would still be needed on their systems.
Ungoverned automation can quickly become a privileged attack path
Ryan McCurdy, VP of Marketing at Liquibase, says: “Glassworm is a reminder that ungoverned automation can quickly become a privileged attack path. Once attackers compromise developer tooling, poison repositories, or steal CI/CD credentials, the pipeline stops being background infrastructure and starts acting like a privileged identity. That is what makes these attacks so dangerous. The answer is not less automation. It is more standardized, governed automation, so the workflows developers and pipelines already rely on are consistent, controlled, and harder to abuse.”
Adversaries have invested heavily in compromising software builders
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity at Suzu Labs, adds: “When dismantling a single developer targeting botnet requires three organizations to simultaneously strike four independent command and control channels, that is a measure of how seriously adversaries have invested in compromising the people who build software.”
He says Glassworm’s operators layered Solana blockchain dead drops and BitTorrent alongside legitimate services like Google Calendar, building infrastructure designed to survive exactly this kind of operation. “This coordination sets a model for how the security community should respond to entrenched supply chain threats. Precision and partnership delivered operational results without years of judicial process.”
Disruption does not reverse more than a year of credential theft
Krell says disruption buys defenders a window. “It does not reverse more than a year of credential theft. Glassworm used credentials stolen in earlier infections to poison over 300 GitHub repositories, the same cascading pattern the industry has tracked across multiple supply chain campaigns this year. Any organization consuming open source software should be checking telemetry against the published indicators now, not waiting for a downstream compromise to surface the exposure.
“Glassworm did not operate in isolation. It ran alongside multiple supply chain campaigns targeting the same developer ecosystems over the same timeframe, including the Shai-Hulud worm and the Megalodon GitHub poisoning disclosed days ago. The volume and persistence of these operations make the case that developer environments and build pipelines require the same zero trust posture organizations have spent a decade applying to users and networks. Any organization that treats its build infrastructure as implicitly trusted is operating on assumptions that adversaries have already invalidated.”
Noelle Murata, Chief Operating Officer at Xcape Inc, believes the coordinated takedown of Glassworm highlights a massive paradigm shift: threat actors are aggressively targeting the software developer’s workstation as the ultimate enterprise entry point. “By targeting IDE marketplaces, package registries, and GitHub repositories rather than traditional corporate networks, the operators behind Glassworm turned infected developer environments into automated launchpads for broader downstream supply chain contamination.
Extreme, multi-layered resilience
“What makes this campaign uniquely menacing is the extreme, multi-layered resilience of its command-and-control (C2) architecture. By hiding C2 infrastructure across the Solana blockchain, the BitTorrent peer-to-peer network, and public Google Calendar entries, the attackers built a decentralized dead-drop engine that could not be dismantled by traditional domain sinkholing or legal hosting takedowns. The fact that defenders had to execute a flawless, simultaneous strike across all four independent technical vectors proves that legacy, siloed perimeter defense is structurally obsolete when fighting a decentralized adversary.
She says for enterprise risk leaders, the Glassworm disruption is a severe warning that developer environments must be treated as highly privileged, zero-trust zones. “To defend against this evolving threat landscape, security executives must immediately enforce strict application control policies on developer IDE extensions, audit code pipelines for unauthorized package installs executing via post-install hooks, and continuously monitor for suspicious, outbound programmatic access to public infrastructure.”
Murata offers several critical takeaways:
- Targeting the pipeline creators: Adversaries are bypassing heavily defended enterprise production environments to compromise developers directly, leveraging their local code-signing access and platform credentials to seamlessly poison entire downstream software lifecycles.
- The resilience of decentralized C2: Utilizing immutable blockchain ledger memo fields and decentralized peer-to-peer hash tables means attackers can permanently maintain connectivity to infected assets without relying on central, tear-down-vulnerable web domains.
- Takedowns are a temporary shield: While disabling the current infrastructure disrupts immediate payload delivery, it does not erase the thousands of malicious, typosquatted npm/PyPI packages and poisoned source files that remain dormant across the broader public code ecosystem.
“When a botnet embeds its command architecture into public blockchains and peer-to-peer networks, traditional security boundaries cease to exist. You aren’t just fighting a group of hackers anymore; you are fighting a permanent, decentralized exploit of the internet’s own infrastructure,” Murata ends.
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.