Reported by 2 outlets
Glassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 Infrastructure
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.50 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CrowdStrike, Google, and the Shadowserver Foundation ran a coordinated disruption of the Glassworm botnet, which had targeted software developers since early 2025 through poisoned open source supply chains: VS Code extensions, npm, PyPI, and more than 300 GitHub repositories. The operation simultaneously severed four resilient C2 channels: Solana blockchain transactions, the BitTorrent DHT peer-to-peer network, the Google Calendar API, and traditional VPS infrastructure. The Russia-linked group behind it infected Windows, macOS, and Linux systems with credential theft malware and the GlasswormRAT remote access tool.
The ecosystem is not clean yet. Socket reported on October 2 a GlassWorm-linked cluster of VS Code themes spanning four Visual Studio Marketplace and six Open VSX extensions, with two confirmed malicious and thousands of installs. The Aurora Nocturne theme was already weaponized as a loader, and brandjacking and name-squatting signals tie the cluster, including the Cosmic Nebula themes, back to GlassWorm.
The takedown forces the adversary to rebuild and exposed tradecraft, but the follow-on findings show residual malicious content still live in both marketplaces after the disruption. Watch for new extension waves or reconstituted C2 on any of the four channels, and developers should audit installed VS Code themes and extensions and treat credentials held on development machines as potentially exposed.
Timeline
-
original reporting
Glassworm Botnet Disrupted — CrowdStrike, Google, and Shadowserver Simultaneously Takedown 4-Layer C2 Infrastructure
cyberscoop.com · 139d ago · May 28th, 2026
The Glassworm botnet, which has been targeting software developers since early 2025 to poison open-source supply chains (VSCode extensions, npm, PyPI, 300+ GitHub repos), was disrupted in a coordinated operation by CrowdStrike, Google, and the Shadowserver Foundation. The operation simultaneously severed access to four distinct C2 channels designed for resilience: Solana blockchain transactions, BitTorrent DHT peer-to-peer network, Google Calendar API, and traditional VPS infrastructure.
The Russia-linked threat group behind Glassworm infected Windows, macOS, and Linux systems with credential theft malware and the GlasswormRAT remote access tool. CrowdStrike's Adam Meyers: "This forces the adversary to rebuild, while exposing tradecraft." The takedown demonstrates how infrastructure disruption can be effective where judicial processes are unavailable.
-
update from socket.dev
(socket.dev) GlassWorm-Linked Malicious VS Code Extensions: A Supply Chain Threat Analysis In brief - This article details the discovery of
socket.dev · 11d ago · October 2nd, 2026
(socket.dev) GlassWorm-Linked Malicious VS Code Extensions: A Supply Chain Threat Analysis In brief - This article details the discovery of
via Mastodon https://socket.dev/blog/glassworm-vscode-themes
-
update from socket.dev
New. Socket: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX https:// socket.dev/blog/glass
socket.dev · 11d ago · October 2nd, 2026
New. Socket: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX https:// socket.dev/blog/glass
via Mastodon https://socket.dev/blog/glassworm-vscode-themes