Glassworm botnet disrupted after resilient C2 infrastructure takedown
Recorded: May 27, 2026, 2 p.m.
| Original | Summarized |
Glassworm botnet disrupted after resilient C2 infrastructure takedown News Featured Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign Laravel Lang packages hijacked to deploy credential-stealing malware Netherlands seizes 800 servers of hosting firm enabling cyberattacks Ubiquiti patches three max severity UniFi OS vulnerabilities Glassworm botnet disrupted after resilient C2 infrastructure takedown FBI warns of in-person data theft attacks from extortion gang Your grocery routine’s easiest upgrade is a Sam’s Club membership for just $25 CISA gives feds 4 days to patch actively exploited cPanel plugin flaw Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityGlassworm botnet disrupted after resilient C2 infrastructure takedown Glassworm botnet disrupted after resilient C2 infrastructure takedown By Ionut Ilascu May 27, 2026 The Glassworm botnet targeting developers in software supply-chain attacks has been disrupted after researchers took down its resilient command-and-control infrastructure relying on Solana blockchain transactions and the BitTorrent DHT network. Glassworm command-and-control architecturesource: CrowdStrike The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: CryptoCurrency Ionut Ilascu Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories FBI warns of Kali365 phishing service targeting Microsoft 365 accounts Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign Anthropic’s restricted Claude Mythos model may be coming to Claude Code Sponsor Posts AI is a data-breach time bomb: Read the new report Protect Your Business from Ecommerce Fraud Overdue a password health-check? Audit your Active Directory for free 33% Rise in Healthcare Credential Theft in 2025: What you need to know Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The Glassworm botnet, which primarily targeted developers through software supply-chain attacks, was successfully disrupted after researchers managed to dismantle its sophisticated and resilient command-and-control command infrastructure. This coordinated operation involved CrowdStrike, Google, and The Shadowserver Foundation, successfully severing access to four distinct command-and-control channels designed specifically to evade conventional disruption methods. The threat had been active since October 2025, initially targeting developers with malicious extensions for OpenVSX and Microsoft VS Code that facilitated the theft of cryptocurrency wallets and developer credentials. Subsequent attack waves expanded to compromise GitHub repositories and npm packages, with one campaign in March affecting over four hundred software artifacts and another involving planting dormant extensions on OpenVSX that activated malicious components upon updates. The longevity of the Glassworm threat stemmed from its specialized C2 infrastructure, which utilized non-traditional communication channels known for their resistance to takedowns. The architecture employed a dynamic front by layering communications across multiple interdependent systems, including blockchain, peer-to-peer networks, and legitimate web services as resolution layers to provide indirection behind the actual control servers. To achieve a complete disruption, the researchers were required to simultaneously target all four communication channels. These channels included reliance on the Solana blockchain, where command-and-control server addresses were encoded within the memo fields of blockchain transactions, creating an immutable, publicly accessible dead drop. Furthermore, the botnet leveraged the BitTorrent Distributed Hash Table (DHT) network, allowing the Glassworm RAT to query the peer-to-peer network for configuration data stored against hardcoded public keys, thereby utilizing a decentralized global network without a single point of failure. Additionally, the operators used public calendar services, embedding Base64-encoded C2 paths within Google Calendar event titles as dead-drop locations. The final layer of communication involved traditional command-and-control infrastructure hosted on commercial virtual private server providers, which served as the mechanism for final payload delivery. Because of this multi-channel design, disrupting any single communication path would have been insufficient, as the threat actors could seamlessly shift communications to an alternate channel to maintain control. The coordinated effort was necessary to interrupt all aspects of the infrastructure, preventing infected machines from receiving new instructions or payloads. Following the successful disruption, all compromised systems began beaconing to a specific IP address, 164.92.88[.]210, which was operated by CrowdStrike. Organizations are advised to monitor for this specific network indicator and implement immediate remediation. Furthermore, the researchers made YARA rules publicly available to assist in confirming infections on suspected hosts. |