The disruption, which was a joint effort among CrowdStrike, Google, and the Shadowserver Foundation, targeted Glassworm’s C2 architecture, which was deliberately engineered for extreme resilience.
A coordinated, cross-sector operation successfully dismantled the Glassworm botnet, a highly persistent and resourced threat known for its multi-pronged compromises of the developer supply chain across Windows, macOS, and Linux systems.
The disruption, which was a joint effort among CrowdStrike, Google, and the Shadowserver Foundation, targeted Glassworm’s C2 architecture, which was deliberately engineered for extreme resilience against conventional takedown attempts. The botnets C2 infrastructure included multiple, redundant channels for communications between the threat actors and the compromised hosts, including typical direct connections to a C2 server, C2 addresses entered into the memo fields of Solana blockchain entries, a public Google calendar in which entry titles served as locations for C2 server paths, and the BitTorrent network.
“Disrupting this architecture required precision and timing. Taking down only one channel would have left the others operational, allowing the operators to quickly reconstitute. All four channels had to be disrupted simultaneously in a coordinated effort. As a result, infected machines can no longer receive new instructions or payloads,” CrowdStrike researchers said in a blog post.
A Multi-Vector Supply Chain Threat
Glassworm's campaign has been active since at least early 2025 and was characterized by its extensive reach across core developer platforms, using a variety of sophisticated techniques to achieve initial compromise and credential harvesting. Software supply chain attacks–especially against individual developers and maintainers of open source projects–have become a serious issue in the last few months, as organized groups such as TeamPCP and others have used a combination of social engineering, credential theft, and other tactics to pull of compromises of a number of high-profile targets, including GitHub, Axios, Instructure, and many others.
“There are dozens of package ecosystems — npm, PyPI, OpenVSX, GitHub repositories — each with millions of packages and limited built-in security controls. Attackers can publish malicious code and reach thousands of victims within minutes. The Glassworm operators cycled through these package ecosystems while maintaining consistent access to developer machines,” CrowdStrike said.
“Disrupting this architecture required precision and timing. Taking down only one channel would have left the others operational."
The operation’s primary attack vectors included:
Once established, the malware deployed a full-featured Node.js remote access tool, dubbed GlasswormRAT, with capabilities spanning information theft and credential harvesting.
A Redundant C2 Architecture
The infrastructure was built to resist single-point failure, utilizing four distinct, redundant communication channels for the botnet’s C2 architecture. This dynamic front protected the actual C2 servers behind multiple layers of indirection.
The four C2 resolution layers were:
The Coordinated Disruption
Disrupting this highly resilient structure took a coordinated effort to sever all four channels at once. A piecemeal approach, taking down only one channel, would have allowed the operators to quickly reconstitute their command structure. The takedown targeted the technical dependencies of the botnet that the adversaries could not easily replace, resulting in infected machines being freed from adversary control, unable to receive new instructions or payloads.
. Over more than a year, the Glassworm operators continuously evolved, adopting new programming languages (from JavaScript to Rust and Zig) and expanding their reach across multiple package ecosystems (VSCode, npm, PyPI, GitHub).
Attribution analysis suggests the threat actors behind Glassworm are likely based in Russia, according to CrowdStrike’s researchers. The malware performs runtime checks on the victim's locale, language settings, and timezone, silently exiting if the machine is determined to be in a CIS country—a common tactic used by cybercriminals in that region to avoid domestic targeting. This behavioral indicator is reinforced by the presence of Russian-language comments in the source code.
