CrowdStrike, Google, and Shadowserver Disrupt "GlassWorm" Developer-Targeted Supply Chain Attack
GlassWorm Malware Infrastructure Dismantled in Coordinated Takedown
Related Entities(initial)
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
In a significant collaborative effort, CrowdStrike, Google, and the Shadowserver Foundation have successfully disrupted a pervasive software supply chain campaign known as GlassWorm. This operation dismantled the command-and-control (C2) infrastructure used by the malware, which has been targeting software developers since at least early 2025. The GlassWorm campaign employed a multi-faceted approach, using malicious Visual Studio Code extensions and compromised software packages to steal credentials, exfiltrate cryptocurrency wallets, and establish a botnet of compromised developer machines. The takedown marks a major victory against threat actors targeting the core of the software development lifecycle.
Threat Overview
The GlassWorm campaign specifically targeted software developers, a high-value target for threat actors due to their privileged access to source code, CI/CD pipelines, and cloud infrastructure. The operators, assessed by CrowdStrike as likely Russia-based cybercriminals, demonstrated persistence and significant resources. The malware was designed to terminate execution if it detected it was running on a system in a Commonwealth of Independent States (CIS) country, a common tactic for Russian threat actors.
The attack vectors included:
- Trojanized VS Code Extensions: Malicious extensions published to the official Microsoft VS Code Marketplace and the open-source Open VSX registry.
- Malicious Packages: Compromised packages uploaded to popular registries like npm (for JavaScript) and PyPI (for Python).
Technical Analysis
The GlassWorm attack was multi-pronged and evolved over time:
- Initial Compromise: Developers were tricked into installing malicious VS Code extensions or using compromised npm/Python packages in their projects (
T1195.002 - Compromise Software Supply Chain). The extensions appeared legitimate but contained a malicious payload. - Credential Theft: Once installed, the initial malware payload would scan the host system for developer credentials. This included GitHub tokens, npm tokens, OpenVSX tokens, SSH keys, and cloud provider credentials (
T1552.001 - Credentials in Files). It also targeted cryptocurrency wallet files. - RAT Deployment: Later versions of the campaign deployed GlassWormRAT, a Websocket-based JavaScript RAT. This RAT provided the attackers with persistent remote access to the compromised machine.
- Data Exfiltration and Espionage: GlassWormRAT was capable of stealing web browser data (cookies, history, passwords), executing arbitrary code, and installing a malicious Google Chrome extension. This extension could capture screenshots, log keystrokes (
T1056.001 - Keylogging), and steal clipboard content (T1115 - Clipboard Data).
This comprehensive data theft framework allowed attackers to not only steal immediate assets but also to pivot and compromise additional repositories and packages, perpetuating the supply chain attack.
Incident Response and Takedown
The disruption was a coordinated effort involving threat intelligence sharing and simultaneous action. CrowdStrike, Google, and the Shadowserver Foundation worked together to identify and sinkhole all known C2 domains associated with GlassWorm. This action effectively severed the connection between the infected developer machines and the attackers, neutralizing the botnet and preventing further data theft and command execution.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
To hunt for similar threats, security teams should look for:
~/.vscode/extensions/npm install, pip installcode.exe or node.exe accessing sensitive files~/.ssh/id_rsa, ~/.aws/credentials, or cryptocurrency wallet files.Detection & Response
- Extension Auditing: Regularly audit installed VS Code extensions and other developer tools. Remove any unverified or unnecessary extensions.
- Behavioral Monitoring: Use an EDR to monitor developer tools for suspicious behavior, such as accessing sensitive files, making outbound network connections, or spawning child processes.
- Supply Chain Security Tools: Utilize tools that scan dependencies for known vulnerabilities and malicious packages before they are incorporated into a project.
- D3FEND: Employ
D3-PA - Process Analysisto detect when developer tools like VS Code begin to exhibit malicious behavior, such as file scanning or unauthorized network communication.
Mitigation
- Vetted Extensions: Create an organizational policy that only allows the installation of VS Code extensions from a pre-approved list of verified publishers.
- Principle of Least Privilege: Developers should not work from accounts with administrative privileges. Use separate, isolated environments for development work.
- Credential Management: Store sensitive credentials and tokens in a secure vault (e.g., HashiCorp Vault, Azure Key Vault) instead of in configuration files on developer machines.
- D3FEND: Implement
D3-EAL - Executable Allowlistingand script-specific controls to restrict what extensions and packages can be installed and executed in the development environment.
Timeline of Events
Article Updates
May 29, 2026
Severity increasedGlassworm botnet used novel C2 channels, including Solana blockchain, BitTorrent DHT, and Google Calendar, making it highly resilient.
New details reveal the Glassworm botnet employed a highly resilient, quad-redundant command-and-control (C2) infrastructure. This included a novel method of embedding C2 server addresses in Solana blockchain transaction memo fields, utilizing BitTorrent DHT, and leveraging Google Calendar events, alongside traditional VPS. This sophisticated approach made the botnet exceptionally resistant to conventional takedown efforts, highlighting the advanced capabilities of the threat actors.
Update Sources:
Timeline of Events
The GlassWorm campaign is believed to have started its operations.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.