CrowdStrike Disrupts Glassworm Botnet that Preyed on Open-Source Supply Chain

CrowdStrike disrupts Glassworm botnet that preyed on open-source supply chain

CrowdStrike has dismantled the Glassworm botnet in an operation aided by Google and Shadowserver, stripping the operators’ access to infrastructure that helped threat actors infect hundreds of pieces of open-source software with malware since early 2025, the company said Tuesday.  The coordinated effort involved the simultaneous takedown of four attacker-controlled servers that were designed to obscure the botnet’s operations and remain resilien…

Coordinated operation takes down Glassworm botnet

The botnet began in early 2025, targeting software developers across the open-source supply chain.

Glassworm botnet disrupted after resilient C2 infrastructure takedown

The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network.

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control (C2) channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions. "Since at least early 2025, GlassWorm operators have systematically targeted software developers, a

Developer-Targeting Glassworm Malware Abuses npm, PyPI, OpenVSX, and GitHub

A dangerous malware campaign known as Glassworm has been spreading through the tools that software developers trust most every day. By abusing popular platforms like npm, PyPI, OpenVSX, and GitHub, the attackers have turned routine development workflows into entry points for data theft, credential harvesting, and persistent system access. The campaign first surfaced in October 2025, when malicious Visual Studio Code and OpenVSX extensions appear…

CrowdStrike, Google slay ‘unkillable’ Glassworm botnet targeting devs

Security vendor CrowdStrike said it has taken down the command and control (C2) channels used by the operators of the Glassworm botnet that has targeted developers since last year. Earlier reports suggested the self-replicating malware’s infrastructure was unkillable due to the use of the immutable and distributed Solana public blockchain for C2 dead-drops. CrowdStrike wrote in its analysis that the Glassworm operators went further in their eff…