BotnetPublished 27 May 2026

Glassworm botnet disrupted after resilient C2 infrastructure takedown

Source Bleeping Computer

Description

The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network. [...]

Impact

The Glassworm botnet compromised software supply chains by distributing malicious extensions and packages that stole cryptocurrency wallets and developer credentials. It affected hundreds of software artifacts and posed a risk to developer environments and downstream users. The botnet's resilient C2 infrastructure allowed it to maintain control over infected hosts despite conventional disruption attempts. The coordinated takedown has halted the botnet's ability to receive new commands or payloads, effectively neutralizing the threat. There are no known active exploits in the wild following this disruption. Organizations with potentially infected machines can detect them via the new beaconing IP address and YARA rules provided by researchers.

Defensive guidance

The Glassworm botnet has been effectively disrupted through a coordinated takedown of all four of its C2 communication channels. Organizations should monitor for network traffic beaconing to the IP address 164.92.88.210, which is controlled by CrowdStrike, as an indicator of infection. Deploy the published YARA rules to identify compromised hosts. Immediate remediation actions should focus on removing infected extensions and packages from developer environments and cleaning affected systems. Since the takedown has neutralized the botnet's control infrastructure, no additional urgent mitigation steps are required beyond detection and cleanup.

References

bleepingcomputer.com/news/security/glassworm-botnet-disrupted-after-resilient-c2-infrastructure-takedown/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 May 2026, 13:33 UTC

References

Community reviews