Home / Technology / Devs Targeted: Glassworm Botnet Dismantled
Devs Targeted: Glassworm Botnet Dismantled
27 May
Summary
- Glassworm botnet targeting developers was dismantled on May 26, 2026.
- It spread via malicious VSCode extensions and poisoned code packages.
- Four C2 channels, including blockchain, were simultaneously disrupted.
A significant global botnet, known as Glassworm, which had been actively targeting software developers since early 2025, was dismantled on May 26, 2026. This operation was a collaborative effort by cybersecurity researchers from CrowdStrike, Google, and the Shadowserver Foundation.
The botnet's primary method of propagation involved trojanized VSCode extensions, poisoned npm and Python packages, and compromised GitHub repositories. Glassworm successfully stole developer credentials and deployed a remote access tool called GlasswormRAT onto Windows, macOS, and Linux systems.
Glassworm's resilience was attributed to its unique command and control (C2) architecture, utilizing four simultaneous channels: the Solana blockchain, BitTorrent DHT, Google Calendar event titles, and traditional VPS servers. This complex infrastructure earned it the moniker 'unkillable botnet'.
The successful takedown required precise, coordinated action to disrupt all four C2 channels simultaneously. This ensured that infected machines could no longer receive malicious instructions or payloads, effectively neutralizing the threat.
