CrowdStrike, Google Shadowserver Dismantle Glassworm Botnet

A coordinated operation by cybersecurity firms CrowdStrike, Google, and the Shadowserver Foundation has successfully dismantled the command-and-control infrastructure of the Glassworm botnet, a persistent malware campaign targeting software developers worldwide. The takedown, executed on May 26, simultaneously disrupted all four of the botnet's resilient communication channels, severing the operators' connection to infected machines.

Glassworm, active since at least early 2025, represents a significant shift in cyber threats by focusing on developers rather than end-users or finished products. The botnet's operators, described by researchers as well-resourced and persistent criminals likely based in Russia, systematically poisoned the open-source software supply chain to gain access to source code repositories, cloud platforms, and package registries.

The malware propagated through multiple vectors, including trojanized extensions for Microsoft Visual Studio Code and its forks, malicious npm and Python packages, and compromised GitHub repositories. CrowdStrike reported that more than 300 GitHub repositories were poisoned using stolen developer credentials. Once installed, the...