Glassworm is a botnet that targeted developers via malicious software supply-chain attacks, including compromised OpenVSX and VS Code extensions, GitHub repositories, and npm packages. Its command-and-control infrastructure was designed for resilience by using four distinct communication channels: Solana blockchain transaction memos encoding C2 addresses, BitTorrent Distributed Hash Table for configuration data retrieval, Google Calendar event titles as dead-drop locations, and traditional VPS-hosted servers. This multi-layered architecture allowed the botnet to survive conventional takedown attempts. A coordinated operation by CrowdStrike, Google, and The Shadowserver Foundation simultaneously disrupted all four channels, effectively neutralizing the botnet's control capabilities. Infected machines now beacon to a CrowdStrike-controlled IP, facilitating detection and cleanup. YARA rules have been released to confirm infections on hosts. The botnet's campaigns included theft of cryptocurrency wallets and developer credentials, with a significant impact on software supply-chain integrity.

The Glassworm botnet compromised software supply chains by distributing malicious extensions and packages that stole cryptocurrency wallets and developer credentials. It affected hundreds of software artifacts and posed a risk to developer environments and downstream users. The botnet's resilient C2 infrastructure allowed it to maintain control over infected hosts despite conventional disruption attempts. The coordinated takedown has halted the botnet's ability to receive new commands or payloads, effectively neutralizing the threat. There are no known active exploits in the wild following this disruption. Organizations with potentially infected machines can detect them via the new beaconing IP address and YARA rules provided by researchers.

The Glassworm botnet has been effectively disrupted through a coordinated takedown of all four of its C2 communication channels. Organizations should monitor for network traffic beaconing to the IP address 164.92.88.210, which is controlled by CrowdStrike, as an indicator of infection. Deploy the published YARA rules to identify compromised hosts. Immediate remediation actions should focus on removing infected extensions and packages from developer environments and cleaning affected systems. Since the takedown has neutralized the botnet's control infrastructure, no additional urgent mitigation steps are required beyond detection and cleanup.