TLDR Tech / InfoSec
Glassworm botnet disrupted after resilient C2 infrastructure takedown
CrowdStrike, Google, and The Shadowserver Foundation have disrupted the developer-targeting Glassworm botnet, active since October 2025 through malicious OpenVSX and VS Code extensions, GitHub repos, and npm packages that stole crypto wallets and developer credentials, by simultaneously severing four deliberately resilient C2 channels: Solana blockchain memo fields, the BitTorrent DHT, Google Calendar event titles holding Base64-encoded paths, and direct VPS connections. Any single channel could fail over to the others, so the operators built indirection layers that only a coordinated, all-at-once takedown could defeat, after which infected hosts can no longer pull new instructions or payloads. Defenders should hunt for compromised machines now beaconing to the CrowdStrike-operated sinkhole at 164.92.88[.]210 and apply the published YARA rules to confirm infections, then remediate the malicious extensions and packages on affected developer endpoints.
Read the full story