Glassworm Botnet Takedown: How Companies Can Defend Themselves Against Software Supply Chain Attacks

Joint operation neutralizes the Glassworm botnet

On May 26, 2026, at 14:00 UTC, the CrowdStrike Counter Adversary Operations team carried out a coordinated operation to neutralize the Glassworm botnet, a global threat targeting software developers through the open-source supply chain. In collaboration with Google and the Shadowserver Foundation, all four of the botnet's command and control (C2) channels were hit simultaneously, disrupting the connection between operators and infected machines and preventing the delivery of new malicious payloads.

An unprecedented threat

Glassworm represents a significant shift in the threat landscape and should serve as a wake-up call for any organization that develops or uses software. Adversaries are no longer just targeting the products but also the developers who create them.

Since the beginning of 2025, Glassworm operators have systematically targeted software developers, who have access to source code repositories, cloud platforms, CI/CD pipelines, and package registries. A single compromised developer can indeed cause a supply chain compromise involving thousands of downstream organizations and users.

Attack techniques

Glassworm used a multi-phase campaign to infect developers:

• Trojanized VSCode extensions published on OpenVSX, disguised as popular tools like time trackers and code formatters. The malicious extensions targeted not only VSCode but also Cursor, Positron, Windsurf, VSCodium, and others.
• Compromised npm and Python packages introducing malicious code through postinstall hooks and configuration scripts, silently executed during dependency installation.
• Over 300 poisoned GitHub repositories using stolen developer credentials, with malicious code inserted into main branches.

This cross-platform operation hit Windows, macOS, and Linux systems, with capabilities ranging from information theft to credential theft and a Node.js remote access tool named GlasswormRAT.

A resilient infrastructure

Glassworm operators designed their infrastructure to withstand attacks. The botnet used four distinct C2 channels:

• Solana Block: C2 server addresses were encoded in the memo fields of blockchain transactions, creating an immutable, publicly accessible dead drop.
• Distributed BitTorrent Hash Table: GlasswormRAT queried the BitTorrent peer-to-peer network for configuration data stored against hardcoded public keys.
• Public calendar service: Glassworm used Google Calendar event titles as dead drop locations for Base64-encoded C2 paths.
• Direct server connections: Traditional C2 infrastructure hosted on commercial VPS providers.

The combination of blockchain, peer-to-peer networks, and legitimate web services as resolution layers was designed to withstand takedowns, protected by multiple layers of indirection.

A model for the future

The takedown of Glassworm demonstrates that:

• Proactive disruption of cyber threats is possible, even against infrastructure designed to withstand attacks.
• Precision strikes can paralyze criminal operations without requiring years-long investigations.
• Collaboration between private intelligence, law enforcement, and technology platforms enables coordinated disruption.

This model should be replicated and strengthened, with the creation of permanent alliances between technology companies, universities, and government agencies.

The geopolitical dimension of the threat

Evidence suggests that Glassworm operators are likely based in Russia. The malware performs checks on the locale, language, and time zone of victims, halting execution if it detects a system in a CIS country. This behavior is typical of Russian cybercriminals seeking to avoid hitting targets close to home.

Russian-language comments in the source code reinforce this hypothesis, although individual clues do not constitute definitive proof. However, the behavior pattern is consistent with tactics observed in other campaigns linked to Russian criminal groups.

This geopolitical dimension underscores the importance of a cybersecurity approach that takes into account international dynamics. Cooperation between allied nations is essential to counter threats that do not recognize national borders.

The importance of proactive prevention

The disruption of Glassworm demonstrates that reacting to attacks is not enough. The rapid spread of malicious packages through dependencies requires a proactive prevention strategy. This includes:

• Adopting secure development practices, such as rigorous dependency verification and the use of private repositories when possible.
• Implementing granular access controls for development environments and build pipelines.
• Integrating static and dynamic analysis tools into the software development lifecycle.
• Continuous training of developers on security best practices.

Organizations must adopt a "security by design" mindset, incorporating security considerations at every stage of the software lifecycle.

Future challenges for software security

The software supply chain remains one of the most critical attack surfaces in the modern computing context. Attackers will continue to exploit the distributed and interdependent nature of development ecosystems to maximize impact with minimal effort.

Organizations must be aware that software security is not a static goal but a continuous process that requires constant investment in technology, people, and processes. Collaboration between developers, security providers, and end-users will be key to addressing future challenges.

The disruption of Glassworm represents a significant step forward, but only the beginning of a longer journey toward a more secure and resilient software supply chain.